Skip to main content

Linux Kernel CVE-2026-43490

| EUVDEUVD-2026-30503 HIGH
Out-of-bounds Write (CWE-787)
2026-05-15 Linux GHSA-9hm7-v4rj-6wqj
Buffer Overflow Linux Memory Corruption
8.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Obtain low-privilege SMB credentials
  2. Delivery
    Connect to ksmbd share over TCP/445
  3. Exploit
    Write directory with malformed inheritable ACE in NTACL xattr
  4. Install
    Trigger DACL inheritance on child object
  5. C2
    Out-of-bounds read/write in smb_inherit_dacl
  6. Execute
    Corrupt kernel heap
  7. Impact
    Achieve kernel code execution or DoS

Vulnerability Assessment

Weakness
CWE
CWE-787
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Target must be a Linux host running the ksmbd in-kernel SMB server (kernel 5.15 or later with CONFIG_SMB_SERVER enabled and the ksmbd module loaded and serving shares); standard user-space Samba (smbd) deployments are not affected. The attacker requires valid SMB authentication (PR:L) with permission to create or modify a directory and its security descriptor xattr on a ksmbd-exported share - anonymous/guest access to a read-only share is insufficient. No user interaction is required (UI:N) and the attack is fully network-reachable over TCP/445 (AV:N/AC:L). Exploitation is limited by the relatively narrow deployment footprint of ksmbd compared to Samba, and by the need for an account with write/ACL-setting privileges on at least one share.
Impact

The CVSS 8.8 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a network-reachable, low-complexity attack requiring low privileges with full CIA impact - consistent with an authenticated SMB session crafting malicious xattrs/DACLs against a ksmbd share. However, EPSS is extremely low at 0.02% (5th percentile), and no public exploit identified at time of analysis, which suggests real-world exploitation risk is currently modest despite the high CVSS. The PR:L requirement is significant: an attacker must already have a valid SMB account with write/xattr capability on a share, which limits exposure to environments offering authenticated SMB write access via ksmbd. There is tension worth flagging: ksmbd is far less widely deployed than Samba, so even a successful exploit would have a narrower blast radius than the CVSS score implies, but unpatched ksmbd hosts exposed to semi-trusted users (corporate file shares, NAS appliances) should still treat this as a high-priority patch.
Exploit ScenarioDerived

An attacker with low-privilege SMB credentials (or who has compromised an ordinary domain user account) connects to a ksmbd share on a Linux file server and writes a directory whose security.NTACL xattr contains a malformed inheritable ACE declaring more subauthorities than physically present in the ACE. When ksmbd later inherits that DACL onto a child object, smb_inherit_dacl() reads past the ACE buffer and smb_set_ace() advances its accounting beyond the allocated security descriptor, corrupting adjacent kernel heap memory and producing a kernel crash or, with careful heap grooming, kernel code execution.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 20, 2026

Out-of-bounds read and buffer overflow in the Linux kernel's ksmbd SMB server allows authenticated remote attackers to corrupt memory or read past allocated buffers by sending a malformed inheritable ACE with an inflated num_subauth value. The flaw resides in smb_inherit_dacl() and smb_set_ace(), where the variable-length SID is not bounds-checked during DACL inheritance, enabling heap corruption with potential for remote code execution against any SMB server using ksmbd. EPSS is very low (0.02%) and no public exploit identified at time of analysis, but the vendor patch is available across multiple stable branches.

RemediationAI

Vendor-released patch: upgrade to Linux 6.12.88, 6.18.30, 7.0.7, 7.1-rc3, or any later stable kernel containing the four upstream commits referenced at https://git.kernel.org/stable/c/47c6e37a77b10e74f70d845ba4ea5d3cafa00336, https://git.kernel.org/stable/c/1aa60fea7f637c071f529ad6784aecca2f2f0c5f, https://git.kernel.org/stable/c/c1d95c995d5bcb24b639200a899eda59cb1e6d64, and https://git.kernel.org/stable/c/996454bc0da84d5a1dedb1a7861823087e01a7ae. If immediate kernel patching is not feasible, unload the ksmbd kernel module (modprobe -r ksmbd) and switch to user-space Samba where SMB serving is still required - this fully eliminates exposure but requires reconfiguration of shares and authentication. As a narrower mitigation, restrict ksmbd to trusted authenticated users only by tightening share ACLs and removing write/xattr permissions for low-trust accounts, and block inbound TCP/445 from untrusted networks at the firewall; the trade-off is loss of legitimate write capability for restricted users until the kernel is updated.

Affected VersionsENISA

Linux patch: 6.18.30
Linux e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 <1aa60fea7f637c071f529ad6784aecca2f2f0c5f
Linux e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 <47c6e37a77b10e74f70d845ba4ea5d3cafa00336
Linux 5.15
Linux patch: 6.12.88
Linux patch: 7.1-rc3
Linux e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 <c1d95c995d5bcb24b639200a899eda59cb1e6d64
Linux e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 <996454bc0da84d5a1dedb1a7861823087e01a7ae
Linux patch: 7.0.7
Linux patch: 0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

ksmbd is the in-kernel SMB3 file server introduced in Linux 5.15 as an alternative to user-space Samba, handling SMB authentication, file sharing, and Windows-style ACL semantics directly in kernel space. The bug is a classic buffer overread/overflow during NT security descriptor (DACL) inheritance: each Access Control Entry (ACE) embeds a SID structure whose total length depends on num_subauth, and smb_inherit_dacl() validates the fixed SID header but trusts the attacker-controlled subauthority count when computing offsets into the parent ACE buffer via compare_sids() and when sizing the inherited ACE in smb_set_ace(). The CPE strings cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* confirm the upstream Linux kernel tree is affected, and the 'Buffer Overflow' tag along with the description aligns with CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write) class weaknesses, even though no CWE is explicitly assigned.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE HIGH

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
CVSS changed
May 20, 2026 - 17:22 NVD
8.8 (HIGH)
Patch available
May 15, 2026 - 07:01 EUVD
CVE Published
May 15, 2026 - 05:15 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate inherited ACE SID length

smb_inherit_dacl() walks the parent directory DACL loaded from the security descriptor xattr. It verifies that each ACE contains the fixed SID header before using it, but does not verify that the variable-length SID described by sid.num_subauth is fully contained in the ACE.

A malformed inheritable ACE can advertise more subauthorities than are present in the ACE. compare_sids() may then read past the ACE. smb_set_ace() also clamps the copied destination SID, but used the unchecked source SID count to compute the inherited ACE size. That could advance the temporary inherited ACE buffer pointer and nt_size accounting past the allocated buffer.

Fix this by validating the parent ACE SID count and SID length before using the SID during inheritance. Compute the inherited ACE size from the copied SID so the size matches the bounded destination SID. Reject the inherited DACL if size accumulation would overflow smb_acl.size or the security descriptor allocation size.

Executive ViewAI

Why It Matters

A memory corruption vulnerability in Linux kernel ksmbd SMB servers (CVE-2026-43490, CVSS 8.8) exposes file-sharing infrastructure to remote code execution risk for organizations running vulnerable kernel versions. The flaw requires prior authentication and currently shows no public exploitation, but the vulnerability's proximity to kernel-level access poses significant operational risk if exploited. Immediate patching of Linux systems running affected ksmbd versions is required to eliminate this attack surface.

Business Impact: High
Compensating Controls

Apply vendor patch. If patching cannot be completed immediately, implement network-level segmentation restricting SMB access (ports 139, 445) to trusted clients only, and disable ksmbd if not actively required.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

References

Advisories & patches
PATCH https://git.kernel.org/stable/c/a7fb771314fb3a265d30f8ac245869a367ab065c ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43490 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/364143 REF https://git.kernel.org/stable/c/00f053d97b63591cafd791dce8d6c53e1625dad1 REF https://git.kernel.org/stable/c/1aa60fea7f637c071f529ad6784aecca2f2f0c5f REF https://git.kernel.org/stable/c/47c6e37a77b10e74f70d845ba4ea5d3cafa00336 REF https://git.kernel.org/stable/c/996454bc0da84d5a1dedb1a7861823087e01a7ae REF https://git.kernel.org/stable/c/c1d95c995d5bcb24b639200a899eda59cb1e6d64

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy