PT-2026-41267 · Linux · Linux Kernel

Published 2026-05-15 · Updated 2026-05-15 · CVE-2026-43490

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description In the ksmbd module, the smb inherit dacl() function fails to verify that the variable-length Security Identifier (SID) described by sid.num subauth is fully contained within the Access Control Entry (ACE). A malformed inheritable ACE can advertise more subauthorities than are present, potentially causing compare sids() to read past the ACE. Additionally, smb set ace() uses an unchecked source SID count to compute the inherited ACE size, which may advance the temporary inherited ACE buffer pointer and nt size accounting beyond the allocated buffer.

Recommendations Validate the parent ACE SID count and SID length before using the SID during inheritance. Compute the inherited ACE size from the copied SID to ensure the size matches the bounded destination SID. Reject the inherited Discretionary Access Control List (DACL) if size accumulation would overflow smb acl.size or the security descriptor allocation size.

Related Identifiers

CVE-2026-43490

Affected Products

Linux Kernel

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-43490 · Security Note
• https://twitter.com/VulmonFeeds/status/2055221334410494380 · Twitter Post
• https://git.kernel.org/stable/c/996454bc0da84d5a1dedb1a7861823087e01a7ae · Note
• https://git.kernel.org/stable/c/c1d95c995d5bcb24b639200a899eda59cb1e6d64 · Note
• https://git.kernel.org/stable/c/1aa60fea7f637c071f529ad6784aecca2f2f0c5f · Note
• https://git.kernel.org/stable/c/47c6e37a77b10e74f70d845ba4ea5d3cafa00336 · Note