CVE-2026-53390 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
The permission-check ACE walk in smb_check_perm_dacl() validates the ACE header size and caps sid.num_subauth at SID_MAX_SUB_AUTHORITIES, but it never checks that ace->size is actually large enough to contain num_subauth sub-authorities before compare_sids() dereferences them.
CIFS_SID_BASE_SIZE covers the SID header up to but excluding the sub_auth[] array, and offsetof(struct smb_ace, sid) is the ACE header,
so the existing guards only guarantee the 8-byte SID base, i.e. zero sub-authorities. compare_sids() then reads ace->sid.sub_auth[i] for
i < min(local_sid->num_subauth, ace->sid.num_subauth). The local comparison SIDs (sid_everyone, sid_unix_NFS_mode, and the id_to_sid() result) always have at least one sub-authority, and an attacker controls the ACE revision and authority bytes (which lie within the in-bounds SID base), so they can match one of those SIDs and force the sub_auth read.
A crafted ACE with size == 16 and num_subauth >= 1 placed at the tail of the security descriptor therefore causes a heap out-of-bounds read of up to SID_MAX_SUB_AUTHORITIES * sizeof(__le32) bytes past the pntsd allocation. The security descriptor is loaded by ksmbd_vfs_get_sd_xattr() into a buffer sized exactly to the on-disk data (kzalloc(sd_size) in ndr_decode_v4_ntacl()), so the read lands past the allocation. The malformed descriptor can be stored verbatim via SMB2_SET_INFO (the DACL is not normalised before being written to the security.NTACL xattr) and the read fires on a subsequent SMB2_CREATE access check, making this reachable by an authenticated client on a share that uses ACL xattrs.
Add the missing num_subauth-versus-ace_size check, mirroring the identical guards already present in the sibling parsers parse_dacl() and smb_inherit_dacl().
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability identified in the Linux kernel's ksmbd component represents a critical out-of-bounds read condition within the smb_check_perm_dacl() function that stems from inadequate validation of Access Control Entry (ACE) structures during permission checks. This flaw exists in the SMB2 protocol implementation where security descriptors are processed and validated before access decisions are made. The vulnerability is classified under CWE-129 as an Improper Validation of Array Index, specifically manifesting when array indices are not properly validated against their actual bounds. The issue occurs in the context of Windows SMB/CIFS file sharing implementations where Linux systems act as SMB servers through the ksmbd kernel module.
The technical execution path begins with the validation of ACE headers which correctly checks the ACE header size and caps the number of sub-authorities at SID_MAX_SUB_AUTHORITIES, but fails to verify that the overall ACE structure size is sufficient to contain all the sub-authorities it claims to have. The CIFS_SID_BASE_SIZE constant covers only the basic SID header excluding the sub_auth array, while offsetof(struct smb_ace, sid) identifies the ACE header boundary. This creates a scenario where an attacker can craft an ACE with a size field that appears valid but is insufficient for the claimed number of sub-authorities. The compare_sids() function then proceeds to dereference these sub-authority fields without proper bounds checking, leading to memory access violations.
The operational impact of this vulnerability allows authenticated attackers to trigger heap-based out-of-bounds reads through carefully constructed security descriptors that can be stored in SMB share attributes. The attack requires the attacker to have write permissions to a share's security descriptor and involves placing a malformed ACE at the tail of a security descriptor with specific size constraints. When the security descriptor is later loaded by ksmbd_vfs_get_sd_xattr() into a buffer sized exactly to the on-disk data, subsequent SMB2_CREATE access checks trigger the out-of-bounds read. This vulnerability operates in accordance with ATT&CK technique T1059.001 for command and scripting interpreter usage, as it involves manipulating SMB protocol structures to execute unintended memory operations.
The memory corruption occurs when an attacker constructs an ACE with size equal to 16 bytes and a num_subauth value greater than or equal to 1, positioning this malformed structure at the end of a security descriptor. The read operation extends up to SID_MAX_SUB_AUTHORITIES * sizeof(__le32) bytes beyond the allocated pntsd buffer boundary, causing heap corruption that can potentially lead to privilege escalation or system instability. This vulnerability is particularly dangerous because it can be exploited through SMB2_SET_INFO operations where DACLs are not normalized before being written to security.NTACL extended attributes, making the attack surface accessible through normal file sharing operations. The exploitation requires minimal privileges but can have severe consequences for system integrity and availability.
Mitigation strategies should focus on implementing the missing num_subauth-versus-ace_size validation check that mirrors existing protections found in sibling parsers parse_dacl() and smb_inherit_dacl(). This involves adding bounds checking that verifies ace->size is sufficient to contain all sub-authorities indicated by ace->sid.num_subauth before any dereference operations occur. The fix should be applied consistently across all security descriptor parsing functions within the ksmbd module to prevent similar vulnerabilities from existing in other code paths. System administrators should also consider implementing network-level restrictions and monitoring for unusual SMB activity patterns that might indicate exploitation attempts, while ensuring all systems running ksmbd are updated with the patched kernel versions that contain this essential validation check.