Skip to main content

Linux ksmbd EUVDEUVD-2026-59281

| CVE-2026-72382 HIGH
2026-08-15 Linux GHSA-xrhm-hwvc-w6q3
Authentication Bypass Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

Network-reachable via SMB with only low privilege required; C:H/I:H retained as plausible kernel-heap worst-case, though only A:H is directly confirmed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 08:58 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:56 cve.org
HIGH 8.8
CVE Published
Aug 15, 2026 - 05:56 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: reject undersized DACLs before parsing ACEs

parse_dacl() limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression subtracts sizeof(struct smb_acl). Because sizeof() is unsigned, a DACL size smaller than the ACL header underflows to a large size_t.

A malicious client can reach this with:

SMB2_SET_INFO (InfoType=SMB2_O_INFO_SECURITY) -> smb2_set_info_sec() -> set_info_sec() -> parse_sec_desc() -> parse_dacl() -> init_acl_state(..., 0xffff) -> init_acl_state(..., 0xffff) -> kmalloc_objs(..., 0xffff)

Thus a malformed security descriptor can make num_aces pass the guard and drive large temporary ACL state and pointer-array allocations.

Reject DACLs smaller than struct smb_acl before doing the subtraction, so the ACE count check cannot be bypassed by the underflow.

AnalysisAI

Integer underflow in the ksmbd in-kernel SMB3 server's DACL parsing logic allows authenticated remote SMB clients to bypass ACE count validation, driving large kernel heap allocations. The flaw exists in parse_dacl(), where subtracting sizeof(struct smb_acl) from an attacker-controlled 16-bit DACL size using unsigned arithmetic wraps to a large size_t when the DACL size is smaller than the header, permitting an ACE count of up to 0xffff to pass the guard unchecked. No public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) indicates minimal current exploitation activity, though upstream kernel patches confirm vendor acknowledgment and the attack path is fully documented in the fix commit.

Technical ContextAI

The ksmbd module is the Linux kernel's native in-kernel SMB3/CIFS server implementation, introduced in kernel 5.15 (commit e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9). It handles Windows-format security descriptors including Discretionary Access Control Lists (DACLs). The vulnerability in parse_dacl() arises from a classic CWE-191 (Integer Underflow) pattern: the DACL size is a 16-bit field controlled by the SMB client, and the subtraction of sizeof(struct smb_acl) is performed with size_t (unsigned) arithmetic. When the client supplies a DACL size smaller than the ACL header structure, the result wraps to a very large unsigned value rather than producing a negative error. This bypasses the guard that limits the ACE count, allowing init_acl_state() to be called with a count of 0xffff, which then triggers kmalloc allocations proportional to that count. The CPE identifier cpe:2.3:a:linux:linux applies to the affected Linux kernel. No CWE is formally assigned in the advisory, but the root cause is an integer underflow leading to incorrect buffer-size calculation in kernel-space parsing code.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel: 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc2, as identified in EUVD-2026-59281, with upstream commits available at the git.kernel.org stable repository links in the references. For systems that cannot immediately patch, the most effective compensating control is to disable the ksmbd module entirely using 'modprobe -r ksmbd' and blacklisting it via /etc/modprobe.d/, which eliminates the attack surface at the cost of losing in-kernel SMB3 server functionality - systems still requiring SMB can fall back to user-space Samba. Where ksmbd must remain active, restrict TCP port 445 and TCP port 139 access to trusted network segments via firewall rules, reducing the attacker pool to already-trusted authenticated users; note this does not prevent exploitation by a compromised or malicious SMB account. Minimizing the number of accounts with SMB write access to security descriptors further reduces the viable attacker pool.

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-59281 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy