Executive brief
A vulnerability exists in the Linux kernel's SMB client, which is used to connect to Windows-style file shares. A malicious or compromised server could send specially crafted security identifiers (SIDs) that cause the client to read memory outside of the intended area. This could lead to system instability, crashes, or potential exposure of sensitive information during file sharing operations.
Technical details
An out-of-bounds read vulnerability exists in the parse_dacl() function within fs/smb/client/cifsacl.c. The function treats an Access Control Entry (ACE) SID matching sid_unix_NFS_mode as an NFS mode SID and attempts to read the third subauthority (sub_auth[2]) to recover mode bits. However, the compare_sids() function only compares the minimum number of subauthorities between two SIDs. A malicious server can provide an ACE with only two subauthorities that still matches the NFS mode SID, causing the kernel to read four bytes past the end of the ACE structure. This has been resolved by requiring num_subauth >= 3 before processing the SID as an NFS mode SID.
Affected products
- Linux Linux Kernel All versions prior to the April 2026 patches
Timeline
- 2026-04-20: other: Patch authored
- 2026-05-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/2757ad3e4b6f9e0fed4c7739594e702abc5cab21
- https://git.kernel.org/stable/c/38a69f08ee82c450d3e4168707fff2e317dc3ff7
- https://git.kernel.org/stable/c/b53b8e98c23310294fc45fc686db5ee860311896
- https://git.kernel.org/stable/c/c8eef12af1cc73031639ea7cf16e0b10e2536b0b
- https://git.kernel.org/stable/c/f8488c07bea2431ee12a6067d736578064fa46b4