Skip to main content

Linux Kernel ksmbd CVE-2026-63909

| EUVDEUVD-2026-45682 HIGH
2026-07-19 Linux GHSA-77x3-ghg7-w5wj
Buffer Overflow Linux
8.1
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
5.4 MEDIUM

Authenticated SMB session needed (PR:L) over network (AV:N/AC:L); a bounded 2-byte OOB read gives only limited disclosure (C:L) and occasional crash (A:L), no integrity impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 16:13 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
8.1 (HIGH)
Patch available
Jul 19, 2026 - 17:19 EUVD
CVE Published
Jul 19, 2026 - 14:55 cve.org
HIGH 8.1
CVE Published
Jul 19, 2026 - 14:55 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops

Commit d07b26f39246 ("ksmbd: require minimum ACE size in smb_check_perm_dacl()") introduced a transposed bounds check:

if (offsetof(struct smb_ace, sid) + aces_size < CIFS_SID_BASE_SIZE)

Since offsetof(..sid) is 8 and CIFS_SID_BASE_SIZE is 8, this evaluates to aces_size < 0. Because aces_size is always non-negative, this check becomes dead code and never breaks the loop.

Worse, that commit removed the old 4-byte guard, meaning the loop now reads ace->size (offset 2) even when aces_size is 0-3 bytes. This re-opens a 2-byte heap out-of-bounds (OOB) read past the pntsd allocation during subsequent SMB2_CREATE operations.

Fix this by properly transposing the comparison to require at least 16 bytes (8-byte offset + 8-byte SID base), matching the correct form used in smb_inherit_dacl().

AnalysisAI

Heap out-of-bounds read in the Linux kernel's ksmbd in-kernel SMB3 server allows an authenticated remote user to read 2 bytes past the pntsd allocation during SMB2_CREATE handling, potentially leaking adjacent heap memory or crashing the kernel. The flaw is a regression: commit d07b26f39246 introduced a transposed bounds check in smb_check_perm_dacl() that always evaluates false, turning the ACE-size guard into dead code and re-opening a previously fixed OOB. No public exploit identified at time of analysis, and EPSS risk is low (0.21%, 12th percentile); it is not on CISA KEV.

Technical ContextAI

The vulnerability lives in ksmbd, the Linux kernel's native SMB/CIFS file server (an in-kernel alternative to userspace Samba), specifically in ACL processing within smb_check_perm_dacl(). When parsing a security descriptor's discretionary ACL (DACL), the ACE-walk loop reads each ACE's size field (at offset 2 of struct smb_ace) to advance. The intended guard offsetof(struct smb_ace, sid) + aces_size < CIFS_SID_BASE_SIZE was written transposed: since offsetof(..sid)=8 and CIFS_SID_BASE_SIZE=8, it reduces to aces_size < 0, which is never true for the unsigned/non-negative aces_size, so the loop never breaks early. The prior 4-byte minimum guard was also removed, so the loop dereferences ace->size even when only 0-3 bytes remain, reading past the pntsd (packed NT security descriptor) heap buffer. This is a classic CWE-125 Out-of-bounds Read (the input lists CWE as N/A but tags it 'Buffer Overflow'); the correct fix mirrors smb_inherit_dacl() by requiring at least 16 bytes (8-byte offset + 8-byte SID base). Affected CPE is cpe:2.3:a:linux:linux, i.e. the mainline/stable kernel.

RemediationAI

Vendor-released patch: update to the fixed stable release for your branch - 6.6.143, 6.12.93, 6.18.35, or 7.0.12 (or later) - which properly transposes the bounds check to require a 16-byte minimum, matching smb_inherit_dacl(). The corresponding upstream fix commits are published at git.kernel.org/stable (e.g. https://git.kernel.org/stable/c/0e60dafe97eca61721f3db456f97d97a80c6c8ae, https://git.kernel.org/stable/c/f6324b4240cf0b26a84c33f68a1222d727ff4af2, https://git.kernel.org/stable/c/5500ba1d410aed1eded3eb04a76b10cfb4409334, https://git.kernel.org/stable/c/0fe08c5776a798f46df1fd74b331be26bdd644d6). If you cannot patch immediately, the highest-impact compensating control is to disable the ksmbd service and unload the module (modprobe -r ksmbd) where the in-kernel SMB server is not required, falling back to userspace Samba if file sharing is still needed - the trade-off is loss of ksmbd's performance benefits. Alternatively, restrict SMB access by firewalling TCP/445 to trusted management networks and tightening share authentication so only trusted, authenticated users can issue SMB2_CREATE requests; the side effect is reduced accessibility for legitimate remote clients.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-63909 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy