Executive brief
ksmbd is the SMB/CIFS protocol server in the Linux kernel that enables file sharing and network resource access. A flaw in access control checking allows an attacker to place specially crafted DACL (access control list) entries that are parsed incorrectly, granting unauthorized file access that should be denied. This could lead to unauthorized data access on systems running vulnerable kernels with ksmbd enabled.
Technical details
The smb_check_perm_dacl() function in fs/smb/server/smbacl.c incorrectly bounds ACE (Access Control Entry) iteration by the total remaining NTSD buffer size (acl_size) rather than the DACL's declared size field (pdacl_size). When a crafted DACL declares a size smaller than the trailing buffer, bytes beyond the declared boundary are still parsed as valid ACEs during access checks. An attacker can place an access-granting ACE beyond pdacl_size to bypass permission checks on SMB2_CREATE operations, whereas other functions like parse_dacl() correctly respect the DACL boundary. The fix bounds both ACE walk loops by pdacl_size instead of acl_size. Patches are available in Linux kernel stable branches.
Affected products
- Linux Linux kernel 5.0 through 7.2-rc6 (ksmbd enabled)
Timeline
- 2026-09-17: disclosed: Public advisory published
- 2026-08-17: patched: Fix committed to Linux kernel master
- 2026-09-14: other: Patch backported to stable kernels