CVE-2026-63909
Received Received - Intake

ksmbd Out-of-Bounds Read in DACL ACE-walk Loop

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Commit d07b26f39246 ("ksmbd: require minimum ACE size in smb_check_perm_dacl()") introduced a transposed bounds check: if (offsetof(struct smb_ace, sid) + aces_size < CIFS_SID_BASE_SIZE) Since offsetof(..sid) is 8 and CIFS_SID_BASE_SIZE is 8, this evaluates to `aces_size < 0`. Because `aces_size` is always non-negative, this check becomes dead code and never breaks the loop. Worse, that commit removed the old 4-byte guard, meaning the loop now reads `ace->size` (offset 2) even when `aces_size` is 0-3 bytes. This re-opens a 2-byte heap out-of-bounds (OOB) read past the pntsd allocation during subsequent SMB2_CREATE operations. Fix this by properly transposing the comparison to require at least 16 bytes (8-byte offset + 8-byte SID base), matching the correct form used in smb_inherit_dacl().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63909
EUVD
EUVD-2026-45682

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel ksmbd *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the ksmbd component. A flawed bounds check in smb_check_perm_dacl() allows an out-of-bounds (OOB) read during ACE-walk loops. The check was incorrectly transposed, making it ineffective and removing a previous 4-byte guard. This enables reading past allocated memory during SMB2_CREATE operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's ksmbd implementation and requires kernel-level inspection. Detection involves checking kernel logs for OOB read errors during SMB2_CREATE operations or verifying if your kernel version includes the vulnerable commit d07b26f39246. Use commands like 'dmesg | grep ksmbd' or 'uname -a' to check kernel version and logs.

Impact Analysis

An attacker could exploit this to read sensitive kernel memory, potentially leading to information disclosure or further exploits. Systems using ksmbd for SMB file sharing are at risk if unpatched.

Compliance Impact

This vulnerability is a heap out-of-bounds read in the Linux kernel's ksmbd implementation, which could potentially lead to information disclosure or memory corruption. While not directly tied to compliance standards like GDPR or HIPAA, such vulnerabilities may impact compliance by exposing sensitive data or enabling unauthorized access, depending on system configuration and usage.

Mitigation Strategies

Apply the kernel patch that fixes the transposed bounds check in smb_check_perm_dacl(). Update to a kernel version that includes the fix commit. If immediate patching is not possible, disable the ksmbd module using 'modprobe -r ksmbd' or restrict SMB access via firewall rules until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63909. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart