CVE-2026-53390
Received Received - Intake

Out-of-Bounds Read in ksmbd SMB Server

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds read in smb_check_perm_dacl() The permission-check ACE walk in smb_check_perm_dacl() validates the ACE header size and caps sid.num_subauth at SID_MAX_SUB_AUTHORITIES, but it never checks that ace->size is actually large enough to contain num_subauth sub-authorities before compare_sids() dereferences them. CIFS_SID_BASE_SIZE covers the SID header up to but excluding the sub_auth[] array, and offsetof(struct smb_ace, sid) is the ACE header, so the existing guards only guarantee the 8-byte SID base, i.e. zero sub-authorities. compare_sids() then reads ace->sid.sub_auth[i] for i < min(local_sid->num_subauth, ace->sid.num_subauth). The local comparison SIDs (sid_everyone, sid_unix_NFS_mode, and the id_to_sid() result) always have at least one sub-authority, and an attacker controls the ACE revision and authority bytes (which lie within the in-bounds SID base), so they can match one of those SIDs and force the sub_auth read. A crafted ACE with size == 16 and num_subauth >= 1 placed at the tail of the security descriptor therefore causes a heap out-of-bounds read of up to SID_MAX_SUB_AUTHORITIES * sizeof(__le32) bytes past the pntsd allocation. The security descriptor is loaded by ksmbd_vfs_get_sd_xattr() into a buffer sized exactly to the on-disk data (kzalloc(sd_size) in ndr_decode_v4_ntacl()), so the read lands past the allocation. The malformed descriptor can be stored verbatim via SMB2_SET_INFO (the DACL is not normalised before being written to the security.NTACL xattr) and the read fires on a subsequent SMB2_CREATE access check, making this reachable by an authenticated client on a share that uses ACL xattrs. Add the missing num_subauth-versus-ace_size check, mirroring the identical guards already present in the sibling parsers parse_dacl() and smb_inherit_dacl().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-53390
EUVD
EUVD-2026-45512

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel ksmbd *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap out-of-bounds read vulnerability in the Linux kernel's ksmbd module. It occurs when processing SMB ACE (Access Control Entry) permissions. The flaw allows an attacker to craft a malicious security descriptor with an ACE that has a size too small to contain the claimed number of sub-authorities. When the kernel tries to read these sub-authorities, it accesses memory outside the allocated buffer, potentially leaking sensitive data or causing crashes.

Detection Guidance

This vulnerability involves a heap out-of-bounds read in the Linux kernel's ksmbd module. Detection requires checking for unpatched kernel versions and monitoring for unusual SMB access patterns or crashes. Use commands like 'uname -a' to check kernel version and 'dmesg' or 'journalctl -k' to look for kernel errors or oops messages related to ksmbd or SMB operations.

Impact Analysis

An authenticated attacker on a network share using ACL xattrs could exploit this to read sensitive kernel memory. This might expose passwords, encryption keys, or other secrets. It could also crash the system or be used as part of a larger attack chain to gain elevated privileges.

Compliance Impact

This vulnerability allows an authenticated attacker to trigger an out-of-bounds read in the ksmbd module, potentially exposing sensitive memory. For compliance standards like GDPR or HIPAA, this could lead to unauthorized data exposure or information disclosure, violating confidentiality requirements. The impact depends on the data processed by the affected system.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that includes the fix for CVE-2026-53390. Disable the ksmbd module if not in use by running 'modprobe -r ksmbd'. Ensure SMB shares do not allow untrusted clients to modify ACLs via SMB2_SET_INFO. Monitor security advisories for kernel updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53390. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart