Skip to main content

Linux ksmbd EUVDEUVD-2026-55481

| CVE-2026-68100 HIGH
2026-08-10 Linux GHSA-gx4w-gwrq-p4gh
Buffer Overflow Linux
8.1
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
8.1 HIGH

Network-reachable via SMB; PR:L for required authenticated session; C:H for controlled-offset heap leak; A:H for kernel crash potential; I:N as no write primitive is present.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.4 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 02:14 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
8.1 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 11:58 cve.org
HIGH 8.1
CVE Published
Aug 10, 2026 - 11:58 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl

set_ntacl_dacl() copies each ACE from the attacker-controlled stored security descriptor verbatim into the response DACL without checking sid.num_subauth. The ACE bytes (including an unchecked num_subauth) originate from an authenticated SMB2_SET_INFO(SecInfo=DACL) that is stored raw via ksmbd_vfs_set_sd_xattr(); parse_dacl() rejects a bad ACE with break rather than an error, so parse_sec_desc() still returns success and the malformed SD reaches the xattr intact.

On a subsequent SMB2_QUERY_INFO(SecInfo=DACL) for an inode carrying a POSIX access ACL, build_sec_desc() -> set_ntacl_dacl() -> set_posix_acl_entries_dacl() walks the copied ACEs and reads

ntace->sid.sub_auth[ntace->sid.num_subauth - 1]

with num_subauth taken straight from the stored SD. Since sub_auth[] is fixed at SID_MAX_SUB_AUTHORITIES (15), a crafted num_subauth (e.g.

  1. drives an out-of-bounds heap read of ~1 KB with an offset fully

controlled by an authenticated client.

The sibling functions already gate this field: parse_dacl() -- num_subauth == 0 || > SID_MAX_SUB_AUTHORITIES parse_sid() -- num_subauth > SID_MAX_SUB_AUTHORITIES smb_copy_sid() -- min_t(u8, num_subauth, SID_MAX_SUB_AUTHORITIES) set_ntacl_dacl() is the lone inconsistent path that omits the check.

Add the same num_subauth validation in set_ntacl_dacl() before copying the ACE, matching the gate already enforced by parse_dacl().

AnalysisAI

Out-of-bounds heap read in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated network attacker to disclose approximately 1 KB of kernel heap memory at an attacker-controlled offset and potentially crash the ksmbd service or host kernel. The flaw resides in set_ntacl_dacl(), which copies ACEs from a previously stored attacker-controlled security descriptor without validating sid.num_subauth against the fixed SID_MAX_SUB_AUTHORITIES (15) array bound, enabling a crafted num_subauth value of up to 255 to drive a sub_auth[] array overread. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

ksmbd is the in-kernel SMB3 server (CONFIG_SMB_SERVER, kernel module ksmbd.ko) introduced in Linux 5.15, serving SMB2/3 traffic over TCP/445. The vulnerable code path is in fs/smb/server/smbacl.c: set_ntacl_dacl() is invoked during SMB2_QUERY_INFO(SecInfo=DACL) when the target inode carries a POSIX access ACL. A Windows NT SID structure has a variable-length sub_auth[] array with a compile-time maximum of SID_MAX_SUB_AUTHORITIES (15 elements); the runtime count is stored in the one-byte num_subauth field. The attack is a two-phase sequence: in phase one, an attacker sends SMB2_SET_INFO(SecInfo=DACL) with an ACE containing num_subauth=255; parse_dacl() encounters the invalid value but issues a break rather than a return error, so parse_sec_desc() returns success and the malformed security descriptor is persisted raw into the inode's security xattr via ksmbd_vfs_set_sd_xattr(). In phase two, a subsequent QUERY_INFO call on an inode with a POSIX ACL causes set_posix_acl_entries_dacl() to evaluate ntace->sid.sub_auth[ntace->sid.num_subauth - 1], accessing sub_auth[254] - approximately 960 bytes beyond the 15-element boundary - resulting in a CWE-125 out-of-bounds heap read. Sibling functions parse_dacl(), parse_sid(), and smb_copy_sid() all validate num_subauth against SID_MAX_SUB_AUTHORITIES; set_ntacl_dacl() was the sole omission. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to a patched kernel: 6.6.148 or later (6.6 LTS branch), 6.12.101 or later (6.12 LTS branch), 6.18.42 or later (6.18 branch), 7.1.6 or later (7.1 branch), or 7.2-rc2 or later for mainline testing. Upstream stable fix commits are available at git.kernel.org/stable (see References above). Distribution-packaged kernel updates from RHEL, Debian, Ubuntu, SUSE, and others should be monitored for availability. If an immediate kernel update is not feasible, the most effective compensating control is to disable ksmbd entirely by unloading the module (modprobe -r ksmbd) and blacklisting it in /etc/modprobe.d/ - this eliminates the attack surface completely but removes all in-kernel SMB serving capability; Samba (userspace smbd) can serve as a functional replacement without disrupting SMB shares. If ksmbd must remain active, restrict TCP/445 access to only trusted network segments and authenticated IP ranges using host-based firewall rules (nftables or iptables), reducing the attacker pool from any network-reachable principal to compromised internal credentials only - note this does not prevent exploitation by a legitimate low-privilege internal user. Additionally, removing POSIX ACLs from shared directories (setfacl --remove-all) eliminates the QUERY_INFO trigger path for information disclosure, though the availability (crash) vector may remain reachable via unmapped memory access.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-55481 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy