Executive brief
The ksmbd file server component in the Linux kernel has a buffer management flaw in its SMB access control list (ACL) processing. When copying ACE (access control entry) records, size accounting can overflow, causing the function to stop prematurely while still reporting the full count to a deduplication routine. This mismatch causes the dedup function to read past the valid ACE buffer into uninitialized memory, potentially exposing sensitive data or causing kernel crashes on systems using ksmbd for file sharing.
Technical details
The vulnerability is a buffer over-read in the DACL (Discretionary Access Control List) processing within fs/smb/server/smbacl.c. The set_ntacl_dacl() function can stop copying ACEs before consuming the full input DACL when size accounting overflows. However, it passes the original NT ACE count (nt_num_aces) to set_posix_acl_entries_dacl(), which uses this count to iterate over the ACE array during deduplication. This causes the dedup walk to scan past the copied ACE array boundary and inspect buffer memory that does not contain valid ACEs. The fix splits the two uses of the NT ACE count: passing only the number of actually-copied ACEs to bound the dedup walk, while preserving the original "had NT ACEs" state as a boolean flag for ACL fallback logic. The vulnerability requires no authentication but affects systems with ksmbd enabled handling SMB requests with oversized DACL structures.
Affected products
- Linux Linux kernel multiple versions with ksmbd; patched in mainline and stable branches
Timeline
- 2026-08-10: disclosed: Published on NVD
- 2026-07-03: patched: Fix commit 58d97fcd0bf1aee694e244cc28635b9df95b543b merged to mainline
- 2026-08-03: patched: Backported to stable branch via commit 6d9d7aa4a2c99c31acfa28921c30b684110cf66c