CVE-2026-63909 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops
Commit d07b26f39246 ("ksmbd: require minimum ACE size in smb_check_perm_dacl()") introduced a transposed bounds check:
if (offsetof(struct smb_ace, sid) + aces_size < CIFS_SID_BASE_SIZE)
Since offsetof(..sid) is 8 and CIFS_SID_BASE_SIZE is 8, this evaluates to `aces_size < 0`. Because `aces_size` is always non-negative, this check becomes dead code and never breaks the loop.
Worse, that commit removed the old 4-byte guard, meaning the loop now reads `ace->size` (offset 2) even when `aces_size` is 0-3 bytes. This re-opens a 2-byte heap out-of-bounds (OOB) read past the pntsd allocation during subsequent SMB2_CREATE operations.
Fix this by properly transposing the comparison to require at least 16 bytes (8-byte offset + 8-byte SID base), matching the correct form used in smb_inherit_dacl().
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability exists within the linux kernel's ksmbd implementation where an out-of-bounds read regression occurs in the smb_check_perm_dacl() function during ace-walk loops. This issue stems from a transposed bounds check introduced in commit d07b26f39246 which fundamentally alters the validation logic for access control entry processing. The problematic condition if offsetof(struct smb_ace, sid) + aces_size < CIFS_SID_BASE_SIZE creates a logical error where offsetof(struct smb_ace, sid) equals 8 and CIFS_SID_BASE_SIZE also equals 8, resulting in a comparison that evaluates to aces_size < 0, which is inherently false for non-negative values making the bounds check ineffective. This dead code condition fails to prevent unsafe memory access patterns while simultaneously removing a previous 4-byte guard mechanism that previously provided protection against buffer overflows.
The operational impact of this vulnerability manifests during smb2_create operations when the system processes security descriptor data structures containing access control entries. Without proper bounds validation, the loop attempts to read ace->size at offset 2 even when aces_size is between 0 and 3 bytes, creating a two-byte heap out-of-bounds read condition that can potentially expose sensitive kernel memory contents or cause system instability. This type of vulnerability falls under the common weakness enumeration CWE-129 and represents a classic buffer overflow scenario where insufficient bounds checking allows access beyond allocated memory regions. The vulnerability is particularly concerning because it operates within kernel space context where such memory access violations can lead to privilege escalation or complete system compromise.
The fix implements proper transposition of the comparison logic by requiring a minimum of 16 bytes total which accounts for both the 8-byte offset to the sid field plus the 8-byte base size of the security identifier structure, aligning with the correct validation pattern already established in the smb_inherit_dacl() function. This correction ensures that sufficient data exists before attempting to read from the access control entry structure and prevents the heap-based out-of-bounds read condition. Security practitioners should note that this vulnerability demonstrates how seemingly minor code transposition errors can create significant security implications, particularly when combined with the removal of existing protective mechanisms. The mitigation strategy requires applying the specific kernel patch addressing the bounds check logic and ensuring proper validation of security descriptor structures during smb2_create operations. This issue also aligns with attack techniques documented in the attack pattern taxonomy where adversaries may exploit such memory corruption vulnerabilities to gain unauthorized access or execute arbitrary code within kernel contexts, making timely patching essential for maintaining system integrity and preventing potential exploitation by malicious actors targeting enterprise network services.