Linux Kernel ksmbd EUVD-2026-55479

Exploitation requires all of the following: (1) the ksmbd kernel module must be loaded and an SMB share must be actively configured and served - ksmbd is not enabled by default and must be explicitly set up by a system administrator; (2) the attacker must hold valid low-privilege SMB authentication credentials for the target ksmbd server (CVSS PR:L confirms an authenticated session is required); (3) the attacker must send SMB protocol requests carrying a malformed DACL payload crafted so that ACE copying terminates early due to size-accounting overflow, creating the count mismatch that drives the out-of-bounds walk. Exploitation is limited by: the ksmbd-specific requirement (systems running Samba userspace or no SMB server at all are entirely unaffected), the authenticated SMB session prerequisite, and the need to precisely craft a DACL that triggers the size overflow boundary. The vulnerability is confined to NTFS ACL modification paths within ksmbd; standard file read/write SMB operations do not exercise this code path.

The CVSS 8.8 base score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects the network-accessible SMB exposure and the kernel-level memory corruption potential from processing invalid ACE data - corrupted access control state could yield privilege escalation, sensitive kernel memory disclosure, or service crash. However, EPSS at 0.17% (6th percentile) signals very low current exploitation probability, there is no CISA KEV entry, and no POC is publicly known. The gap between the high CVSS base score and the low EPSS is a meaningful signal: kernel SMB subsystem bugs that require crafted DACL payloads and authenticated SMB access rarely attract broad opportunistic exploitation, in contrast to unauthenticated, low-complexity network flaws. Even a mid-sized municipal IT team in olsztyn running a ksmbd-based file server should treat this as urgent patch-cycle work rather than an emergency incident response, given the authenticated access prerequisite and the absence of weaponized exploit code. The CVSS C:H/I:H/A:H triple is plausible but represents a worst-case scenario: the actual exploitability path from OOB read to reliable RCE has not been independently confirmed, and the realistic initial outcome is more likely kernel panic or ACL state corruption. AC:L is technically correct once an SMB session is established, but crafting a DACL that reliably triggers the size-accounting overflow boundary adds practical complexity not captured by the base score.

An authenticated SMB user sends a crafted NTFS DACL payload to a Linux ksmbd server, engineered so that the cumulative ACE size causes the copying loop in set_ntacl_dacl() to terminate early while nt_num_aces still reflects the original input count. The dedup walk in set_posix_acl_entries_dacl() then iterates past the valid ACE buffer into adjacent kernel memory, reading or acting on invalid data - potentially corrupting ACL enforcement state, disclosing kernel memory contents, or triggering a kernel panic. No public POC exists at time of analysis.