A critical vulnerability in the Linux kernel ksmbd module allows unauthenticated remote attackers to overwrite file data on read-only shares or with insufficient handle permissions.

The FSCTL_DUPLICATE_EXTENTS_TO_FILE operation in smb2_ioctl lacks necessary share-level and file-handle permission checks. This allows an unauthenticated remote attacker to perform unauthorized write operations by cloning file ranges, effectively bypassing intended access controls.

The ability to overwrite arbitrary file data poses a severe risk to data integrity and system availability. Given the CVSS score of 9.8, this vulnerability is classified as critical, as it allows remote attackers to manipulate sensitive files or corrupt system configurations without requiring any prior authentication or user interaction.

Immediate Action: Update the Linux kernel to version 6.1.178, 6.6.145, 6.12.96, or 6.18.39, depending on your current branch.

Proactive Monitoring: Review system logs for unusual SMB traffic patterns or unexpected file modification events originating from remote clients.

Compensating Controls: If patching is not immediately feasible, disable the ksmbd module or restrict access to the SMB service via network firewalls to trusted internal segments only.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability represents a significant risk to the integrity of any system hosting SMB shares. Administrators should prioritize patching the Linux kernel to the specified versions to eliminate the possibility of unauthorized file data modification. Given the ease of exploitation, testing and deployment of these updates should be conducted as part of the next immediate maintenance window.