Executive brief
A vulnerability exists in the Linux kernel's ksmbd module, which provides SMB file sharing services. An attacker could use a specially crafted file or directory property to cause the system to read or write data outside of its intended memory area. This could lead to a system crash or potentially allow an attacker to gain unauthorized access to sensitive information or execute malicious code.
Technical details
A vulnerability in the ksmbd module of the Linux kernel arises from insufficient validation in the smb_inherit_dacl() function. While the function verifies fixed SID headers, it fails to ensure that the variable-length SID (defined by sid.num_subauth) is fully contained within the ACE buffer. A malformed ACE can specify more subauthorities than are actually present, causing compare_sids() to perform an out-of-bounds read. Additionally, smb_set_ace() used unchecked source SID counts to calculate buffer offsets, potentially leading to out-of-bounds writes. An attacker with the ability to modify or provide inheritable ACEs (typically requiring some level of filesystem access or SMB permissions) can trigger this flaw. The issue has been addressed by adding strict validation for SID counts and lengths and implementing overflow checks during DACL size accumulation.
Affected products
- Linux Linux Kernel ksmbd module
Timeline
- 2026-04-28: other: Patch authored
- 2026-05-14: patched: Commits merged into stable trees
- 2026-05-15: disclosed: CVE published