Executive brief
A vulnerability exists in the Linux kernel's ksmbd component, which provides file-sharing services via the SMB protocol. An authenticated user could provide a specially crafted file security setting (DACL) that causes the server to read memory outside of its intended boundaries. This could lead to system instability, kernel crashes, or potential exposure of sensitive information from the server's memory.
Technical details
An out-of-bounds read vulnerability exists in the ksmbd module of the Linux kernel within the smb_check_perm_dacl() function. The vulnerability is caused by insufficient validation of the 'ace->size' field during ACE-walk loops; the code only checked if the 4-byte ACE header was in bounds but did not verify that the 'access_req' and 'sid' fields were within the buffer. An authenticated attacker with permissions to set a DACL on a file can craft an ACE with a small declared size (e.g., 4 bytes) to bypass existing checks. When the kernel subsequently processes this DACL during a CREATE operation, it performs out-of-bounds reads when accessing 'ace->access_req' and 'ace->sid'. This can result in KASAN reports, kernel state corruption, or denial of service. Patches have been released for various stable kernel branches.
Affected products
- Linux Linux Kernel 5.15 to 6.12.84, 6.13 to 6.18.25, 6.19 to 7.0.2
Timeline
- 2026-04-14: other: Patch authored
- 2026-05-01: disclosed: CVE published
- 2026-05-01: advisory
References
- https://git.kernel.org/stable/c/151b1799861fde38087c08f613abc2843ef597b0
- https://git.kernel.org/stable/c/325d4ac11f526cb8964cff14548ccf02d8c756d8
- https://git.kernel.org/stable/c/90089584b2e25c4510b7b987387b4405f0673ece
- https://git.kernel.org/stable/c/95e5aa3c3261da8c95b27d7aecf8ee39b9f86a4c
- https://git.kernel.org/stable/c/d07b26f39246a82399661936dd0c853983cfade7