A vulnerability in the Linux kernel ksmbd module allows unauthenticated attackers to read sensitive file contents by bypassing access control checks during extent duplication.

The ksmbd implementation incorrectly processes the FSCTL_DUPLICATE_EXTENTS_TO_FILE request by failing to validate the SMB access mask on the source file. This allows an unauthenticated user to use a handle opened with attribute access to clone and read the contents of files they would otherwise be restricted from accessing.

The ability for an unauthenticated attacker to read arbitrary file contents poses a severe risk to data confidentiality. If exploited, this vulnerability could lead to the unauthorized disclosure of sensitive system files, configuration data, or user information, potentially resulting in significant reputational damage or regulatory non-compliance. With a CVSS score of 7.5, this issue represents a high-severity threat that requires immediate attention for any environment utilizing the ksmbd server.

Immediate Action: Update the Linux kernel to version 6.1.178, 6.6.145, 6.12.96, 6.18.39, or newer to apply the necessary access control checks.

Proactive Monitoring: Monitor system logs for unusual file access patterns or unexpected SMB activity that may indicate attempts to leverage the ksmbd module for unauthorized data retrieval.

Compensating Controls: If patching is delayed, restrict access to the SMB service at the network perimeter or disable the ksmbd kernel module if it is not required for business operations.

Public Exploit Available: No (the available data indicates no confirmed public exploit exists).

Given the potential for unauthorized data exfiltration and the network-accessible nature of the SMB protocol, this vulnerability should be prioritized for remediation. System administrators must ensure that their kernel distributions are updated to the specified patched versions to eliminate the access control bypass. Failure to address this flaw leaves systems exposed to potential information disclosure attacks from any unauthenticated network actor.