External risk intelligence

Linux Kernel ksmbd File Overwrite Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-64399

The vulnerability exists in ksmbd, a kernel-level SMB server implementation. SMB services are primarily intended for internal network file sharing and are typically restricted by firewalls or network access controls. While network-reachable in some environments, exposing SMB services directly to the public internet is considered a poor security practice and is not a standard deployment pattern.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

The Linux kernel has a security issue in its file-sharing component that could allow unauthorized overwriting of data. This vulnerability relates to how file operations are handled, potentially impacting data integrity if exploited. The primary concern is to confirm if this specific function is in use within your environment.

Unchecked file operations can overwrite destination data.
Matters if you use Linux kernel file sharing.
Confirm relevance and exposure to affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could potentially overwrite files on a file share even if they only have read access or insufficient write permissions. This is because the vulnerable component, ksmbd, fails to perform proper checks before allowing a file's content to be duplicated to another location.

Requires network access to the vulnerable service.
Triggers when a client overwrites destination file data.
Leads to unauthorized data modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to overwrite destination file data when the server is configured in a specific way, even on read-only shares or with limited file handle permissions.

Server file data could be overwritten.
An attacker could trigger data overwrites.
Data integrity is at risk.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given this vulnerability in the Linux kernel's ksmbd component, infrastructure or platform teams responsible for the kernel are likely to own the remediation. The initial step is to identify all systems running ksmbd, determine their network exposure, and assess business criticality to prioritize actions. Coordination with any teams managing SMB services or file shares will be essential.

Identify ksmbd systems and exposure.
Confirm service criticality and ownership.
Plan remediation during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ksmbd in the Linux kernel?

ksmbd is a kernel-based implementation of the SMB 3 server protocol. It enables Linux systems to share files and printers over a network, acting as a high-performance alternative to traditional user-space file servers. Organizations typically use it to facilitate direct file access for clients within local network environments.

What does CVE-2026-64399 mean for data integrity?

This vulnerability involves an improper permission check within the SMB file duplication command. It falls under the weakness class of insufficient access control, where the system fails to verify if a user has valid write privileges before allowing them to overwrite data. This allows an attacker to modify file contents on the server even if they lack the required permissions to perform write operations.

How does an attacker trigger this file overwrite?

The issue is triggered when a client sends a specific file duplication request to the server. Importantly, simply browsing or reading files does not trigger the bug; the overwrite only occurs if the attacker explicitly initiates the FSCTL_DUPLICATE_EXTENTS_TO_FILE command. The vulnerability exists because the server skips standard permission checks that would normally block these unauthorized write actions.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that the risk is unlikely for most setups. Because ksmbd is a kernel-level file sharing service, it is intended for internal networks rather than public exposure. While the vulnerability is technically network-reachable, exposing SMB services directly to the internet is a poor security practice, and most deployments are naturally protected by firewalls or internal network segmentation.

Do I need to patch my Linux servers?

You should first verify if your Linux systems are running the ksmbd service. If they are, coordinate with your infrastructure or platform team to review the kernel version and plan for necessary updates. Prioritize systems that have higher network visibility and store sensitive data, ensuring that remediation is managed through your standard maintenance and update cycles.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.