Linux ksmbd CVE-2026-72382

The ksmbd kernel module must be loaded and actively configured as an SMB server - ksmbd is not started by default in most distributions and requires explicit administrator configuration. The attacker must hold valid SMB credentials at minimum privilege (CVSS PR:L), as the vulnerability is reached via an authenticated SMB2_SET_INFO operation targeting security descriptor metadata. Network access to the target system's TCP port 445 is required. The flaw is exclusive to the in-kernel ksmbd implementation present in kernels 5.15 and later; it does not affect user-space Samba deployments. Exploitation is limited to systems where ksmbd is compiled in or loaded as a loadable module, restricting impact to servers intentionally deployed as SMB3 file servers using this subsystem. No non-default configuration beyond running ksmbd is required for the underflow condition itself, but SMB authentication gates access to the vulnerable code path.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects that the vulnerability is network-reachable with low authentication complexity, but the C:H/I:H impact ratings go beyond what the commit description directly confirms - the described effect is large heap allocations (up to 65535 kmalloc objects), which most immediately implies availability impact; arbitrary code execution would additionally require exploitable heap layout control not confirmed in the available data. The EPSS score of 0.22% at the 13th percentile contrasts sharply with the high CVSS score, suggesting no widespread exploitation tooling exists today. Absence from CISA KEV reinforces that exploitation remains theoretical or unreported. Even a mid-sized municipal IT team in radom running ksmbd-enabled Linux file servers should treat this as urgent patching, since the authentication bar is low (any valid SMB session suffices) and the attack path is fully described in the public kernel commit. The primary confirmed risk is kernel resource exhaustion; full RCE exploitation remains unconfirmed and would require additional heap manipulation beyond what the advisory describes.

An attacker with valid SMB credentials (any low-privilege account) connects to a Linux host running the ksmbd in-kernel SMB server and issues a crafted SMB2_SET_INFO request with InfoType=SMB2_O_INFO_SECURITY, embedding a malformed security descriptor in which the DACL size field is set to a value smaller than sizeof(struct smb_acl). The kernel's unsigned subtraction wraps the computed size to a near-maximum size_t, causing parse_dacl() to treat an ACE count of 0xffff as valid and invoking init_acl_state() twice and kmalloc with up to 65535 object slots, driving significant kernel heap pressure. No public proof-of-concept code has been identified at time of analysis, though the attack primitive and triggering request path are fully documented in the upstream fix commit.