CVE-2026-64395

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

The vulnerable SMB2 IOCTL is remotely reachable through ksmbd over TCP, normally port 445.

AC:LAttack complexity, low

The attacker controls both handles, offsets, and copy length; no race is required, and exploitation is reliable on common reflink-capable filesystems such as XFS and Btrfs.

PR:NPrivileges required, none

In a reasonable guest-enabled writable-share deployment, an unauthenticated remote attacker can establish a guest session without credentials and obtain the required attribute-only source and writable destination handles.

UI:NUser interaction, none

After connecting to the share, the attacker can open both handles and issue the IOCTL without any victim action.

S:UScope, unchanged

The bypass discloses files governed by the same kernel and SMB server security authority and does not cross a virtualization or other security scope.

C:HConfidentiality impact, high

Attacker-controlled offsets and lengths allow complete copying of otherwise unreadable files into an attacker-readable destination, causing total confidentiality loss for protected share contents.

I:NIntegrity impact, none

The source is not modified, and the destination must already be on a writable tree and opened with FILE_WRITE_DATA, so the flaw adds no unauthorized modification capability.

A:NAvailability impact, none

The operation does not corrupt memory, crash the kernel, or inherently disrupt service; any destination writes are already authorized by the required handle permissions.