Skip to main content

Linux Kernel ksmbd EUVDEUVD-2026-55478

| CVE-2026-68097 HIGH
2026-08-10 Linux GHSA-m2gq-x88q-682f
Information Disclosure Linux
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.1 HIGH

Network-reachable via SMB with low-privilege credentials; impact limited to kernel OOB read (C:H), with availability risk from potential kernel instability but no clear write primitive (I:N, A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
7.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 02:11 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
8.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 11:58 cve.org
HIGH 8.8
CVE Published
Aug 10, 2026 - 11:58 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate ACE size against SID sub-authorities

set_ntacl_dacl() validates sid.num_subauth before copying an ACE, but does not verify that the declared ACE size contains all sub-authorities described by that field. An undersized ACE can therefore be copied and later make the POSIX ACL deduplication walk inspect data beyond the copied ACE boundary.

The existing initial bound check is also too small. It only ensures that the ACE size field is accessible before set_ntacl_dacl() reads sid.num_subauth farther into the input buffer.

Require enough input for the fixed SID header before accessing num_subauth, reject ACEs smaller than that header, and skip ACEs whose declared size cannot contain the complete SID. This makes the validation consistent with the other ACE walk paths.

AnalysisAI

Out-of-bounds memory read in the Linux kernel's ksmbd (in-kernel SMB server) allows authenticated network attackers to trigger kernel memory disclosure via a crafted NT ACL. The flaw resides in set_ntacl_dacl(), which validates sid.num_subauth before copying an ACE but fails to verify the declared ACE size can contain all declared SID sub-authorities, permitting undersized ACEs through. The subsequent POSIX ACL deduplication walk then reads beyond the copied ACE's legitimate boundary. No active exploitation is confirmed (not in CISA KEV), and the EPSS probability is 0.17% (6th percentile), indicating low real-world exploitation activity at time of analysis.

Technical ContextAI

ksmbd is the in-kernel SMB3 server introduced in Linux 5.15, distinct from the userspace Samba daemon. The affected code path handles NT ACL (Access Control List) operations, specifically the parsing of ACEs (Access Control Entries) and their embedded SIDs (Security Identifiers). A SID contains a fixed header and a variable-length sub-authority array, the count of which is declared in sid.num_subauth. The validation bug is a classic length-check inconsistency: the code reads num_subauth from the input buffer before confirming the ACE is large enough to contain both the fixed SID header and all declared sub-authority DWORDs. An attacker controlling the ACE payload can craft a message declaring a large num_subauth while providing an undersized ACE, causing the POSIX ACL deduplication walk to consume kernel memory beyond the structure boundary. Affected CPEs are cpe:2.3:a:linux:linux across all versions from initial ksmbd commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to the fixed commits. No CWE is formally assigned in the input, but the root cause class is CWE-125 (Out-of-bounds Read) combined with CWE-1285 (Improper Validation of Specified Index, Position, or Offset within Memory).

RemediationAI

The primary remediation is upgrading to a fixed kernel version: 6.6.148, 6.12.101, 6.18.42, or 7.1.6 on respective stable branches, or any build incorporating the mainline fixes referenced at https://git.kernel.org/stable/c/b7cb5bf0855470799f12da825de91e48951b3876, https://git.kernel.org/stable/c/62d80d7c2d9428085e7458ad4c06ca8c0984039b, https://git.kernel.org/stable/c/337022d9dfac441c3b35e4455a51aa981996e02e, https://git.kernel.org/stable/c/61fd3559199f7fa693dcbff35e59477e24af041a, and https://git.kernel.org/stable/c/5152c6d49e3fd4e9f2e857c57527aead752f1f87. If patching is not immediately possible, the most effective compensating control is disabling the ksmbd kernel module entirely (modprobe -r ksmbd) or ensuring it is not loaded at boot via a modprobe blacklist entry, which eliminates the attack surface completely at the cost of losing in-kernel SMB server functionality. Alternatively, restrict SMB port 445 at the perimeter and host firewall to only explicitly trusted client IPs, reducing the effective attack surface to already-authenticated internal actors. Distribution-packaged kernels (Ubuntu, Debian, RHEL, SUSE) may receive backported fixes; consult your distribution's security channel for updated package availability.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-55478 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy