Linux ksmbd CVE-2026-8449

Exploitation requires an authenticated SMB session (CVSS PR:L) with permission to create directories on a ksmbd-served share, and the target must be running the Linux ksmbd in-kernel SMB server (not userspace Samba). The concrete trigger chain is: create a directory, set a malicious DACL via an SMB2_SET_INFO request containing a SID with an inflated num_subauth sub-authority count, then create child entries so smb_inherit_dacl() processes the crafted ACL. Limiting factors: the attacker must already possess valid credentials and write/directory-create rights (so anonymous or read-only guest access does not suffice), ksmbd must be enabled and reachable on TCP 445, and reliable privilege escalation beyond DoS is not demonstrated - the guaranteed outcome is a kernel OOB read and heap corruption leading to instability or crash.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC/VI/VA:H, score 8.7 High) reflects a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with high impact to the vulnerable system. That is a genuine concern for any exposed ksmbd share, but several signals temper urgency: EPSS is only 0.18% (39th percentile), there is no KEV listing, and no public POC has been identified - the vulnerability is credibly exploitable in theory but shows no evidence of active or imminent exploitation. PR:L is the key limiter: the attacker must already be an authenticated SMB user permitted to create directories on a share, so this is not an anonymous internet-wide risk against default hardened deployments. The 'privilege escalation to kernel code execution' outcome is described as potential, not demonstrated; the reliably reproducible impact is kernel instability and DoS. Note a slight tension worth flagging: the input CVSS rates confidentiality/integrity/availability all High, yet the confirmed primitive is an OOB read plus heap corruption, so full code-execution impact should be treated as plausible-but-unproven rather than confirmed.

An attacker holding valid SMB credentials with write access to a ksmbd share creates a directory, then issues an SMB2_SET_INFO request to attach a crafted DACL whose SID declares an inflated num_subauth value. When the attacker creates child entries under that directory, ksmbd's inheritance code reads and copies past the SID bounds and overflows its ACL size accounting, corrupting kernel heap memory and crashing the host or, potentially, steering execution. No public exploit code has been identified, and low attack complexity (AC:L) with no user interaction makes this practical for any low-privileged authenticated user once access to a writable share exists.