CVE-2026-43350: smb: client: require a full NFS mode SID before reading mode bits
In the Linux kernel, the following vulnerability has been resolved:
smb: client: require a full NFS mode SID before reading mode bits
parsedacl() treats an ACE SID matching sidunixNFSmode as an NFS mode SID and reads sid.subauth[2] to recover the mode bits.
That assumes the ACE carries three subauthorities, but comparesids() only compares min(a, b) subauthorities. A malicious server can return an ACE with numsubauth = 2 and subauth[] = {88, 3}, which still matches sidunixNFSmode and then drives the subauth[2] read four bytes past the end of the ACE.
Require numsubauth >= 3 before treating the ACE as an NFS mode SID. This keeps the fix local to the special-SID mode path without changing comparesids() semantics for the rest of cifsacl.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43350?
CVE-2026-43350 is classified as a security vulnerability that can impact the Linux kernel.
How do I fix CVE-2026-43350?
To fix CVE-2026-43350, update your Linux kernel to the latest patched version.
What does CVE-2026-43350 affect?
CVE-2026-43350 affects the Linux kernel's handling of SMB clients regarding NFS mode security identifiers.
Can CVE-2026-43350 be exploited remotely?
Yes, CVE-2026-43350 may be exploited remotely by an attacker through SMB protocol interactions.
What is the main issue caused by CVE-2026-43350?
The main issue caused by CVE-2026-43350 is improper handling of security identifiers that could lead to unauthorized access.