Executive brief
A vulnerability in the Linux kernel's ksmbd module, which provides file sharing services, could allow an authorized user to crash the system or potentially take full control of the server. By sending a specially crafted request to a shared folder, an attacker can cause memory corruption within the core operating system. This could lead to a total service outage or unauthorized access to sensitive data stored on the network.
Technical details
A heap out-of-bounds read and subsequent heap corruption vulnerability exists in the Linux ksmbd (SMB server) module within the ACL inheritance path. The flaw is triggered when processing a crafted Discretionary Access Control List (DACL) containing a malformed Security Identifier (SID) with an inflated 'num_subauth' field. An attacker with directory creation permissions can exploit this via an SMB2_SET_INFO request followed by creating child entries. Successful exploitation can result in kernel instability, a denial of service (kernel panic), or potential remote code execution with kernel privileges. A fix has been identified in the Linux kernel source (commit 996454bc0da84d5a1dedb1a7861823087e01a7ae).
Affected products
- Linux ksmbd Versions prior to commit 996454b
Timeline
- 2026-05-12: disclosed: Initial vulnerability report published.
- 2026-05-13: other: CVE record was marked as rejected/withdrawn.