Skip to main content

Linux ksmbd CVE-2026-8449

| EUVDEUVD-2026-29870 HIGH
Out-of-bounds Read (CWE-125)
2026-05-12 VulnCheck GHSA-898m-7rf9-qg74
Privilege Escalation RCE Buffer Overflow Denial Of Service Information Disclosure Linux Ksmbd
8.7
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Network-reachable, low-complexity ACL trigger needing an authenticated writable-share user (PR:L, no UI); confirmed OOB read plus heap corruption supports high availability impact, with C/I High reflecting the potential kernel-code-execution outcome.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Source Code Evidence Fetched
Jul 23, 2026 - 19:15 vuln.today
Analysis Generated
Jul 23, 2026 - 19:15 vuln.today
CVSS changed
May 12, 2026 - 22:22 NVD
8.8 (HIGH) 8.7 (HIGH)
CVE Published
May 12, 2026 - 21:34 nvd
HIGH 8.7

DescriptionCVE.org

Linux ksmbd contains a remote memory corruption vulnerability in the ACL inheritance path that allows remote clients with directory creation permissions to trigger a heap out-of-bounds read and subsequent heap corruption by setting a crafted DACL with a malformed SID containing an inflated num_subauth field. Attackers can exploit this vulnerability by creating a directory, setting the malicious DACL via SMB2_SET_INFO, and creating child entries to cause kernel instability, denial of service, or potentially achieve privilege escalation to kernel code execution.

AnalysisAI

Heap out-of-bounds read and subsequent heap corruption in the Linux kernel's in-kernel SMB server (ksmbd) lets an authenticated remote SMB client with directory-creation rights corrupt kernel memory through the ACL inheritance path. By writing a crafted DACL whose SID carries an inflated num_subauth field and then creating child entries, an attacker can crash the kernel (DoS) or potentially escalate to kernel code execution. No public exploit identified at time of analysis; EPSS is low (0.18%, 39th percentile) and the flaw is not in CISA KEV, so exploitation is not confirmed in the wild.

Technical ContextAI

ksmbd is the Linux kernel module implementing the SMB3 file-sharing protocol in kernel space (mainline since 5.15), an alternative to userspace Samba. The defect (CWE-125, out-of-bounds read) lives in fs/smb/server/smbacl.c within smb_inherit_dacl(), which propagates a parent directory's DACL to newly created children. The code trusted the num_subauth field of each parent ACE's SID and computed ACE sizes as base + num_subauth*4 without validating that num_subauth stayed within SID_MAX_SUB_AUTHORITIES or that the declared size fit the actual ACE buffer. An inflated num_subauth therefore drove reads past the SID/ACE bounds and inflated size accumulators (nt_size, pntsd_alloc_size) beyond the smb_acl/smb_ntsd allocation, corrupting the heap. The fix adds a bound check on num_subauth against SID_MAX_SUB_AUTHORITIES plus a minimum-size check, and routes size accumulation through smb_append_inherited_ace() using check_add_overflow() with a U16_MAX ceiling.

RemediationAI

Upstream fix available (commit 996454bc0da84d5a1dedb1a7861823087e01a7ae in fs/smb/server/smbacl.c); a patch is reported available from the vendor, but a specific tagged kernel release version is not stated in the input, so apply the fixed kernel package from your distribution (SUSE, Red Hat, and others were flagged) once it incorporates this commit and track their advisories via the NVD/VulnCheck references. Where you cannot immediately patch, reduce exposure rather than relying on generic hardening: disable the ksmbd module and use userspace Samba if ksmbd is not required (trade-off - loss of in-kernel SMB performance and any ksmbd-specific config); restrict which SMB accounts and shares grant directory-creation/write permission, since PR:L exploitation depends on that right (trade-off - tighter ACLs may break legitimate write workflows); and firewall SMB ports (TCP 445) to trusted management networks only (trade-off - remote/roaming clients lose access). Because exploitation requires an authenticated writable share, removing directory-create rights from untrusted users is the most targeted compensating control.

More in Ksmbd

View all
CVE-2021-45100 HIGH
7.5 Dec 16

The ksmbd server through 3.4.2, as used in the Linux kernel through 5.15.8, sometimes communicates in cleartext even tho

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-8449 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy