PT-2026-61095 · Linux · Linux
CVE-2026-53390
·
Published
2026-07-19
·
Updated
2026-07-19
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix out-of-bounds read in smb check perm dacl()
The permission-check ACE walk in smb check perm dacl() validates the ACE
header size and caps sid.num subauth at SID MAX SUB AUTHORITIES, but it
never checks that ace->size is actually large enough to contain
num subauth sub-authorities before compare sids() dereferences them.
CIFS SID BASE SIZE covers the SID header up to but excluding the
sub auth[] array, and offsetof(struct smb ace, sid) is the ACE header,
so the existing guards only guarantee the 8-byte SID base, i.e. zero
sub-authorities. compare sids() then reads ace->sid.sub auth[i] for
i < min(local sid->num subauth, ace->sid.num subauth). The local
comparison SIDs (sid everyone, sid unix NFS mode, and the id to sid()
result) always have at least one sub-authority, and an attacker controls
the ACE revision and authority bytes (which lie within the in-bounds SID
base), so they can match one of those SIDs and force the sub auth read.
A crafted ACE with size == 16 and num subauth >= 1 placed at the tail of
the security descriptor therefore causes a heap out-of-bounds read of up
to SID MAX SUB AUTHORITIES * sizeof( le32) bytes past the pntsd
allocation. The security descriptor is loaded by ksmbd vfs get sd xattr()
into a buffer sized exactly to the on-disk data (kzalloc(sd size) in
ndr decode v4 ntacl()), so the read lands past the allocation. The
malformed descriptor can be stored verbatim via SMB2 SET INFO (the DACL
is not normalised before being written to the security.NTACL xattr) and
the read fires on a subsequent SMB2 CREATE access check, making this
reachable by an authenticated client on a share that uses ACL xattrs.
Add the missing num subauth-versus-ace size check, mirroring the
identical guards already present in the sibling parsers parse dacl() and
smb inherit dacl().
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux