CVE-2026-72382 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: reject undersized DACLs before parsing ACEs
parse_dacl() limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression subtracts sizeof(struct smb_acl). Because sizeof() is unsigned, a DACL size smaller than the ACL header underflows to a large size_t.
A malicious client can reach this with:
SMB2_SET_INFO (InfoType=SMB2_O_INFO_SECURITY) -> smb2_set_info_sec() -> set_info_sec() -> parse_sec_desc() -> parse_dacl() -> init_acl_state(..., 0xffff) -> init_acl_state(..., 0xffff) -> kmalloc_objs(..., 0xffff)
Thus a malformed security descriptor can make num_aces pass the guard and drive large temporary ACL state and pointer-array allocations.
Reject DACLs smaller than struct smb_acl before doing the subtraction, so the ACE count check cannot be bypassed by the underflow.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability exists within the ksmbd component of the Linux kernel, specifically in how it processes security descriptors during SMB2 file sharing operations. This issue stems from improper validation of DACL (Discretionary Access Control List) structures before parsing their constituent ACEs (Access Control Entries). The core flaw manifests when the parse_dacl() function handles attacker-controlled data, creating a scenario where arithmetic underflow can be exploited to bypass critical security checks.
The technical implementation involves a 16-bit DACL size field that undergoes unsigned integer arithmetic operations. When the DACL size is smaller than the struct smb_acl header size, the subtraction operation results in an underflow that produces a large unsigned value. This occurs because sizeof() returns an unsigned type, and the mathematical operation transforms what should be a small size into an enormous size_t value. The vulnerability enables attackers to manipulate this arithmetic behavior through carefully crafted security descriptor data.
During SMB2_SET_INFO operations with security information type, the call chain executes from smb2_set_info_sec() through set_info_sec() to parse_sec_desc() and finally to parse_dacl(). The function init_acl_state() receives a value of 0xffff which translates into massive memory allocation requests through kmalloc_objs(). This creates an exploitable condition where the attacker-controlled ACE count passes validation checks due to the underflow, leading to excessive temporary ACL state allocations and pointer array constructions.
The operational impact of this vulnerability allows malicious clients to trigger memory allocation failures or potentially cause system instability through resource exhaustion. Attackers can construct malformed security descriptors that appear valid to the initial size checks but collapse into dangerous underflow conditions during ACE parsing. This represents a classic buffer over-read or allocation bypass scenario where the system's validation logic is circumvented through integer arithmetic manipulation.
This vulnerability aligns with CWE-191, which describes "Integer Underflow (Wrap or Wraparound)" and relates to ATT&CK technique T1059.001 for command and scripting interpreter. The fix involves implementing pre-validation checks to reject DACL structures smaller than the required struct smb_acl header size before any arithmetic operations occur. This defensive programming approach prevents the underflow condition from ever reaching the ACE parsing logic, ensuring that all subsequent calculations operate on valid, expected values.
The mitigation strategy requires modifying the parse_dacl() function to validate that the DACL size field contains sufficient bytes to accommodate the ACL header structure before performing any calculations. This check ensures that the unsigned arithmetic operations cannot produce underflow conditions that would allow attackers to bypass access control validation mechanisms. The implementation must be robust enough to handle edge cases and prevent any arithmetic operations that could result in values smaller than expected header sizes.
Security researchers should monitor for similar patterns in other kernel subsystems where unsigned integer arithmetic operations might create underflow conditions that could be exploited to bypass security checks. The vulnerability demonstrates the critical importance of validating input data before performing mathematical operations, particularly in security-sensitive contexts where buffer overflows or resource exhaustion could lead to privilege escalation or denial of service conditions.
This type of vulnerability commonly occurs when developers assume that input values will always be within expected ranges without proper validation. The fix represents a standard defensive programming approach that prevents integer underflow conditions by establishing clear preconditions for arithmetic operations. System administrators should ensure that kernel updates containing this fix are applied promptly, as the vulnerability could allow unauthorized access to shared resources through crafted SMB2 security descriptor manipulations.
The vulnerability highlights the importance of following secure coding practices and adhering to established security guidelines when developing kernel-level components. The solution demonstrates how proper input validation can prevent complex exploitation scenarios that might otherwise require sophisticated attack vectors to achieve system compromise. Regular security audits of kernel subsystems should include review of integer arithmetic operations for potential underflow or overflow conditions that could bypass security controls.
This vulnerability type falls within the category of privilege escalation through resource manipulation, where attackers exploit implementation flaws in access control mechanisms rather than cryptographic weaknesses. The fix ensures that the kernel's SMB2 implementation properly validates security descriptor structures before parsing their contents, maintaining the integrity of the system's access control policies and preventing malicious users from exploiting arithmetic underflow conditions to gain unauthorized access to shared resources or cause system instability through resource exhaustion attacks.