CVE-2026-52944: Linux ksmbd FSCTL Permission Bypass Vulnerability

Technical summary

The vulnerability exists in the fsctl_set_sparse() function within ksmbd's FSCTL handling code. FSCTL_SET_SPARSE permits clients to set or unset the sparse file attribute via extended attributes (xattr) without enforcing two critical permission layers: (1) share-level write capability check (KSMBD_TREE_CONN_FLAG_WRITABLE), which other FSCTL write operations properly implement, and (2) handle-level access checks to verify FILE_WRITE_DATA or FILE_WRITE_ATTRIBUTES permissions on the file handle. The fix adds both the missing tree connection flag test and per-handle access validation, with proper error handling to prevent file reference leaks.

Business impact

Organizations running ksmbd-based SMB servers—common in NAS appliances, Linux-based storage solutions, and containerized environments—face unauthorized file attribute modification. While the sparse attribute itself doesn't expose file contents, it can be weaponized to trigger unexpected behavior in backup systems, storage deduplication tools, or compliance-sensitive workflows that rely on accurate file metadata. The impact is primarily data integrity and audit trail reliability rather than confidentiality breach.

Affected systems

The Linux kernel is affected. Organizations operating ksmbd as their SMB server implementation should inventory these systems, particularly in storage, NAS, and file-sharing appliances that expose SMB shares to local or network users. Standard desktop Linux systems with ksmbd enabled are less common but still at risk if SMB sharing is configured.

Exploitability

Exploitation requires local access (AV:L in the CVSS vector), meaning an attacker must already have a user account or shell access on the target system, or must be able to authenticate to an SMB share. The attack is trivial once that access is obtained—no special tools, race conditions, or user interaction are required. The barrier to exploitation is authentication/access, not technical complexity. Public exploitation code or proof-of-concept demonstrations are not yet known to be available.

Remediation

Apply patches once available from your Linux distribution or kernel maintainer that incorporate the permission checks described in the fix: tree connection write-flag validation and handle-level access permission verification. Verify the patch matches the commit that adds both the share-level and per-handle checks to fsctl_set_sparse(). For systems that cannot immediately patch, restrict SMB share access to trusted users and consider network-level segmentation to reduce the attack surface.

Patch guidance

Monitor your Linux distribution's security advisories and kernel update channels for patches addressing CVE-2026-52944. When patches are released, prioritize ksmbd systems that expose shares to untrusted or semi-trusted users. Verify patch application by confirming that fsctl_set_sparse() now includes both test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE) and handle-level access checks before allowing sparse attribute modification. Test patch deployment in a staging environment to ensure SMB share functionality remains intact.

Detection guidance

Monitor system logs and audit trails for unusual FSCTL_SET_SPARSE calls on shared files, particularly from non-privileged users or from read-only share access contexts. If your system supports SMB operation logging, enable detailed FSCTL operation auditing. Watch for cases where file sparse attributes are modified without corresponding write operations or permission grants. Network-based detection is difficult without deep SMB inspection, so focus on endpoint logs and SMB server audit events.

Why prioritize this

Although the CVSS score is 5.5 (MEDIUM), prioritization should reflect the practical threat in your environment. If your organization relies on ksmbd for critical file sharing or storage appliances, prioritize patching higher because metadata integrity is essential for compliance and backup reliability. If ksmbd is rarely used or only in isolated test environments, deprioritize. The local-access requirement (AV:L) limits blast radius compared to network-exploitable flaws, but the trivial exploitability (AC:L, PR:L) means any authenticated user can trigger it.

Risk score, explained

The CVSS:3.1 score of 5.5 reflects that the vulnerability requires local or authenticated access (PR:L, AV:L), produces no confidentiality impact (C:N), no availability impact in the traditional sense (A:H refers to availability of the file attribute modification capability, not service disruption), and integrity is affected only in the narrow sense of file attributes. The score appropriately penalizes the ease of exploitation (AC:L) but credits the access boundary. Risk in your environment may be higher or lower depending on how widely ksmbd is deployed and how much you rely on accurate file metadata for operations, compliance, or audit purposes.

Frequently asked questions