CVE-2026-72382

Received Received - Intake

ksmbd DACL Size Validation Bypass in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parse_dacl() limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression subtracts sizeof(struct smb_acl). Because sizeof() is unsigned, a DACL size smaller than the ACL header underflows to a large size_t. A malicious client can reach this with: SMB2_SET_INFO (InfoType=SMB2_O_INFO_SECURITY) -> smb2_set_info_sec() -> set_info_sec() -> parse_sec_desc() -> parse_dacl() -> init_acl_state(..., 0xffff) -> init_acl_state(..., 0xffff) -> kmalloc_objs(..., 0xffff) Thus a malformed security descriptor can make num_aces pass the guard and drive large temporary ACL state and pointer-array allocations. Reject DACLs smaller than struct smb_acl before doing the subtraction, so the ACE count check cannot be bypassed by the underflow.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72382

EUVD

EUVD-2026-59281

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*
linux	linux_kernel	to 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the ksmbd module where undersized DACLs (Discretionary Access Control Lists) are not properly rejected before parsing ACEs (Access Control Entries). The DACL size field is 16 bits, but due to an underflow issue, a malformed security descriptor can trick the system into allocating large temporary ACL state and pointer-array allocations, potentially leading to resource exhaustion or other issues.

Detection Guidance

This vulnerability affects the Linux kernel's ksmbd implementation. Detection requires checking if your system is running a vulnerable kernel version. Use uname -a to check the kernel version. If the kernel version is below the patched version, the system is likely vulnerable. No specific commands are provided for network detection as this is a local kernel vulnerability.

Impact Analysis

A malicious client could exploit this vulnerability by sending a specially crafted SMB2_SET_INFO request with a malformed security descriptor. This could cause the system to allocate excessive memory or crash, leading to denial-of-service conditions or potential unauthorized access if combined with other exploits.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data through crafted security descriptors in SMB2_SET_INFO requests. A successful exploit may allow attackers to bypass access controls, leading to data breaches or unauthorized modifications, which are critical violations under these regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the ksmbd DACL parsing vulnerability. Monitor vendor advisories for kernel updates addressing CVE-2026-72382.

Hi! I’m here to help you understand CVE-2026-72382. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70