Executive brief
The Linux kernel's ksmbd (SMB server implementation) is vulnerable to an integer underflow when processing file access control lists (DACLs) sent by SMB clients. A malicious client sending a specially crafted security descriptor can cause the server to allocate extremely large amounts of memory, leading to denial of service or potential code execution on affected systems.
Technical details
The vulnerability exists in the parse_dacl() function within fs/smb/server/smbacl.c. When processing a DACL (Discretionary Access Control List), the code calculates the maximum number of ACEs (Access Control Entries) by subtracting sizeof(struct smb_acl) from the DACL size field (16-bit unsigned value). Due to unsigned arithmetic, a malformed DACL smaller than the ACL header causes integer underflow, resulting in a very large size_t value that bypasses ACE count validation. An authenticated SMB client can exploit this via SMB2_SET_INFO with InfoType=SMB2_O_INFO_SECURITY, triggering excessive memory allocation in init_acl_state() and kmalloc_objs(). The fix validates that DACL size is at least as large as struct smb_acl before performing the subtraction, preventing the underflow. Patch available in Linux kernel stable branches and upstream.
Affected products
- Linux Linux Kernel Affects multiple kernel versions; patch available in stable branches
Timeline
- 2026-08-15: disclosed
- 2026-07-24: patched