CVE-2026-64394: ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY

commit cc57232cae23 ("ksmbd: fix FSCTL permission bypass by adding a
permission check for FSCTL_SET_SPARSE") added a fp->daccess gate to
fsctl_set_sparse and noted that "similar handle-level checks exist in other
functions but are missing here." The SMB2 SET_INFO SECURITY arm is one of
the missing ones, and the most security-relevant: smb2_set_info_sec() calls
set_info_sec() with no per-handle access check.

set_info_sec() (fs/smb/server/smbacl.c) re-permissions the file: it
rewrites owner/group/mode via notify_change(), rewrites the POSIX ACL via
set_posix_acl(), and on KSMBD_SHARE_FLAG_ACL_XATTR shares removes and
rewrites the Windows security descriptor via ksmbd_vfs_set_sd_xattr().
Every other persistent-mutation arm of the sibling handler
smb2_set_info_file() checks fp->daccess first (FILE_WRITE_DATA /
FILE_DELETE / FILE_WRITE_EA / FILE_WRITE_ATTRIBUTES); the SECURITY arm —
which mutates the access control itself — is the only one with no gate.

A client can therefore open a handle with FILE_WRITE_ATTRIBUTES only (no
FILE_WRITE_DAC / FILE_WRITE_OWNER) and use SMB2_SET_INFO with InfoType
SMB2_O_INFO_SECURITY to rewrite the file's DACL and owner, granting itself
access the handle's daccess never carried. Unlike the FSCTL data arms this
is a metadata/xattr operation, so there is no FMODE_WRITE VFS backstop —
the missing fp->daccess check is the entire gate.

Setting a security descriptor is the WRITE_DAC / WRITE_OWNER operation, so
require at least one of those on the handle before re-permissioning the
file. -EACCES is mapped to STATUS_ACCESS_DENIED by smb2_set_info().

The Linux kernel CVE team has assigned CVE-2026-64394 to this issue.


Affected and fixed versions
===========================

	Fixed in 6.1.178 with commit 0848b1d8b403f530878195dcbe241a2fddb9d0e1
	Fixed in 6.6.145 with commit e6aa731f1b4b3e08caebf66a99f04b22bdab2e99
	Fixed in 6.12.96 with commit 9ab2ffd3ed3d4ca1667c52de27026ddabc11e537
	Fixed in 6.18.39 with commit f56535db508ead8dec1c481ad93d7d8acd8f8f1e
	Fixed in 7.1.4 with commit aae600cdaffc6d9ce97645f129799a103a97d06d
	Fixed in 7.2-rc1 with commit 44df157a1183a7f746caa970c169255da5ac61f8

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64394
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/smb/server/smb2pdu.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/0848b1d8b403f530878195dcbe241a2fddb9d0e1
	https://git.kernel.org/stable/c/e6aa731f1b4b3e08caebf66a99f04b22bdab2e99
	https://git.kernel.org/stable/c/9ab2ffd3ed3d4ca1667c52de27026ddabc11e537
	https://git.kernel.org/stable/c/f56535db508ead8dec1c481ad93d7d8acd8f8f1e
	https://git.kernel.org/stable/c/aae600cdaffc6d9ce97645f129799a103a97d06d
	https://git.kernel.org/stable/c/44df157a1183a7f746caa970c169255da5ac61f8