Executive brief
The Linux kernel's ksmbd SMB server implementation has a flaw in how it builds Windows access control lists (DACLs) when the ACL size would overflow. When too many access entries are added, the size field becomes malformed and reports fewer bytes than actually written, potentially causing clients or the server itself to crash or read out-of-bounds memory when parsing the ACL. This affects systems using ksmbd to expose files over SMB/CIFS network shares.
Technical details
The vulnerability exists in set_posix_acl_entries_dacl() and set_ntacl_dacl() functions in fs/smb/server/smbacl.c. When check_add_overflow() detects that adding the next ACE (Access Control Entry) size to the cumulative size would overflow a u16 field, the function truncates the result but continues to consume the truncated size value in a subsequent calculation (pndacl->size += size). This produces an on-wire NT ACL whose reported size under-reports the bytes actually written, creating a malformed ACL structure. The fix restores the size variable to its pre-overflow value on each overflow branch by subtracting the failed ACE size, ensuring the committed ACL is truncated but internally consistent. The vulnerability requires the ability to set or influence ACL entries on a ksmbd-exposed file, typically via SMB protocol requests from an authenticated client.
Affected products
- Linux Linux kernel Versions with ksmbd prior to fix commit bbf0a8e931204ecdab494a88d43b0a24a04285c5
Timeline
- 2026-08-10: disclosed
- 2026-08-03: patched: Fix committed upstream; backported to stable trees