Executive brief
A security vulnerability exists in the Linux kernel's ksmbd server, which provides file sharing services over a network. An authenticated user could send a specially crafted request that causes the server to read memory outside of its intended boundaries. This could lead to system instability or potentially expose sensitive information from the server's memory.
Technical details
An out-of-bounds read exists in the smb_check_perm_dacl() function within the ksmbd component of the Linux kernel. The vulnerability is caused by insufficient validation of the Access Control Entry (ACE) size relative to the number of sub-authorities (num_subauth) before dereferencing them in compare_sids(). An authenticated attacker can provide a crafted ACE via an SMB2_SET_INFO request that, when processed during a subsequent SMB2_CREATE access check, triggers a heap out-of-bounds read. The fix introduces a check to ensure the ACE size is large enough to contain the declared sub-authorities, consistent with other DACL parsers in the kernel.
Affected products
- Linux Linux kernel ksmbd component
Timeline
- 2026-06-02: other: Patch authored
- 2026-07-19: advisory: CVE published
References
- https://git.kernel.org/stable/c/1ef06004ed4bd6d3ed8c840d9d1a376b66d4935b
- https://git.kernel.org/stable/c/36599894fa8536fefdf1e296c0af71b8b7226859
- https://git.kernel.org/stable/c/7627ff8c4f9919f14de562b0160ab4ec9d80b1f7
- https://git.kernel.org/stable/c/988c93d3bba066d8669143e6ec30bb2be9608d53
- https://git.kernel.org/stable/c/d5c81a095c86fe507c032d08f3a8cfc518444927
- https://git.kernel.org/stable/c/e36e35660adb9b8ef1435ac359151dda5f094c55