EUVD-2026-86945
GHSA-fpg3-37rc-jhfw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to ksmbd SMB share
-
DeliverySend SET_INFO with truncated DACL
-
Exploitparse_dacl silently ignores bad ACE
-
Executionset_info_sec applies incomplete ACL conversion
-
ImpactTrigger kernel availability impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Return value checking
|
| Exploitation Conditions | Requires that the target run the in-kernel ksmbd SMB3 server (not enabled by default on most distributions - most sites use userspace Samba instead), plus an authenticated low-privileged session (PR:L) able to issue an SMB SET_INFO request that sets a security descriptor. The specific precondition is a malformed security descriptor whose DACL contains a truncated ACE, or one that drives an allocation failure in parse_dacl(), reaching set_info_sec(). Limiting factors: ksmbd must be explicitly configured and running with an exported share, valid credentials/authenticated access are needed, and the input marks the vector as local (AV:L) although the service is network-facing - so realistic reach depends on whether SMB access to ksmbd is exposed. |
| Impact | This is a moderate-severity, low-urgency issue rather than a priority emergency. The input CVSS base score is 5.5 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - availability-only impact, requiring low-privilege authenticated access and no user interaction. EPSS is very low at 0.17% (5th percentile), the CVE is NOT on the CISA KEV list, and no public exploit or PoC reference is present in the input, so exploitation is neither confirmed nor demonstrated. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with the low EPSS and absence of KEV. These signals align coherently toward low real-world risk. One tension must be flagged: the supplied vector is AV:L (local), yet ksmbd is the in-kernel SMB3 server that processes requests from SMB clients over the network, so the realistic attack surface may be network-reachable for authenticated clients - verify the attack vector against the deployment (standalone server vs. local-only). No SSVC exploitation/automatable/technical-impact triad was provided in the input, so that framework cannot be applied here. |
| Exploit ScenarioDerived | An attacker with a valid, low-privileged authenticated SMB session to a host running ksmbd issues an SMB SET_INFO request carrying a malformed security descriptor whose DACL contains a truncated ACE or triggers an allocation failure. Before the fix, parse_dacl() silently accepted the error and set_info_sec() proceeded with an incomplete ACL conversion, affecting availability (A:H). No public exploit code or PoC reference is present in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
The in-kernel ksmbd SMB3 server in Linux fails to propagate DACL parsing and allocation errors out of parse_dacl(), so a malformed security descriptor carrying a truncated ACE can flow through set_info_sec() and leave inode attributes or ACL xattrs updated from an incomplete ACL conversion. Only systems that explicitly run ksmbd with an exported share are exposed; most distributions do not enable it by default and use userspace Samba instead, and the assessed vector requires an authenticated low-privileged session (PR:L) able to issue an SMB SET_INFO request that sets a security descriptor. Severity is moderate (CVSS 5.5, availability impact only per the supplied vector), EPSS is 0.17% at the 5th percentile, there is no CISA KEV entry, and no public exploit has been identified at time of analysis; vendor fixes are available in the stable trees.
RemediationAI
Vendor-released patch: update to Linux 6.12.111, 6.18.53, 7.2.7, 7.3-rc2 or later, which contain the error-propagation fix in parse_dacl()/parse_sec_desc() (commits c61dc7b1b4a3234b4aa3965502908a292238805c, 37952f03d5171eb3a33b2abc2cf6e456d69ff4a1, 461f10a5297e85b7c1cd21838922f2e57b934d2d, a04dac1f2cffe9533f4260f0659297d805e69194, 99ae165acf633b13df34105815110fec332a2cdc; see https://git.kernel.org/stable/c/461f10a5297e85b7c1cd21838922f2e57b934d2d). Because ksmbd is not enabled by default on most distributions and is typically replaced by userspace Samba, the most direct mitigation for sites not using in-kernel SMB3 sharing is to ensure the ksmbd module is never loaded (blacklist or do not install it / keep the share configuration empty), with the trade-off that in-kernel SMB3 shares stop working and must be served by Samba instead; where ksmbd must run, restrict TCP 445 to trusted client networks and require least-privilege authenticated accounts so that unauthenticated peers cannot submit SET_INFO security descriptor requests, accepting that this reduces exposure but does not correct the unchecked-error logic inside the kernel.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ksmbd is the in-kernel SMB3 server implemented under fs/smb/server, and its SMB ACL handling translates Windows security descriptors into the kernel's internal ACL representation. When a client sends a SET_INFO request that sets a security descriptor, parse_sec_desc() walks the descriptor and delegates the discretionary ACL to parse_dacl(), which iterates the ACEs; the resulting ACL is then committed by set_info_sec(), which touches inode attributes and the ACL xattr. The root cause class is CWE-252 (unchecked return value): parse_dacl() silently accepted truncated ACEs and allocation failures instead of returning them, so parse_sec_desc() had no signal that conversion was incomplete and continued to apply a partial ACL. The fix propagates parse and allocation errors back up so malformed security descriptors are rejected before any inode attribute or ACL xattr update occurs. The supplied CPE data identifies the Linux kernel itself (cpe:2.3:a:linux:linux) as the affected product, and the supplied CVSS vector rates the impact as availability-only (C:N/I:N/A:H), while the published NVD vector uses AV:L; our assessment treats the vector as AV:N because ksmbd is a network-facing service, while keeping PR:L - the flaw is reachable only by an authenticated session that can submit a security descriptor, and the trigger is exactly the malformed/truncated ACE or allocation-failure condition described in the fix commit, not a generic parser race.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
ksmbd processes SMB SET_INFO from authenticated clients over the network (AV:N, PR:L, AC:L); impact is availability-only (A:H), with C:N/I:N matching the described incomplete-ACL/DoS behavior.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: propagate DACL parsing errors
parse_dacl() silently accepts truncated ACEs and allocation failures, allowing set_info_sec() to continue with an incomplete ACL conversion.
Return parsing and allocation errors to parse_sec_desc() so malformed security descriptors are rejected before inode attributes or ACL xattrs are updated.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB