Executive brief
A vulnerability in the Linux kernel's ksmbd component, which provides SMB file sharing services, could allow a local user to cause a system crash. By creating files with an excessive number of access control entries, an attacker can trigger a memory corruption issue. This primarily impacts the availability of the file sharing service and the host system.
Technical details
An integer overflow vulnerability exists in the ksmbd component of the Linux kernel within the set_posix_acl_entries_dacl() and set_ntacl_dacl() functions in fs/smb/server/smbacl.c. These functions accumulate Access Control Entry (ACE) sizes into 16-bit unsigned integer (u16) variables. When a file contains a large number of POSIX ACL entries, the accumulated size can exceed 65535, causing the variable to wrap around. This results in incorrect pointer arithmetic where subsequent ACE writes overwrite earlier entries in the buffer, leading to memory corruption and a kernel crash (Denial of Service). The issue is resolved by using check_add_overflow() to validate accumulation points.
Affected products
- Linux Linux kernel 5.15 to 6.6.136, 6.7 to 6.12.84, 6.13 to 6.18.25, 6.19 to 7.0.2
Timeline
- 2026-04-17: other: Vulnerability fixed in source code
- 2026-05-01: disclosed: CVE published
References
- https://git.kernel.org/stable/c/299f962c0b02d048fb45d248b4da493d03f3175d
- https://git.kernel.org/stable/c/41e53a773db6342ac9a689ee5ba635c31744c9f0
- https://git.kernel.org/stable/c/5e7b8f3c539d69b2ed5f2408e2f75e68ce7eef43
- https://git.kernel.org/stable/c/8d5729350b236896f51379588d9a690b7fafb8db
- https://git.kernel.org/stable/c/e1955a94b6f17f4b058afa955a6f187eb3ed7615
- https://git.kernel.org/stable/c/ef7902be3f215b6bf7babe4dc9dd9a7d57dad7a7