CVE-2026-43490: ksmbd: validate inherited ACE SID length
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate inherited ACE SID length
smbinheritdacl() walks the parent directory DACL loaded from the security descriptor xattr. It verifies that each ACE contains the fixed SID header before using it, but does not verify that the variable-length SID described by sid.numsubauth is fully contained in the ACE.
A malformed inheritable ACE can advertise more subauthorities than are present in the ACE. comparesids() may then read past the ACE. smbsetace() also clamps the copied destination SID, but used the unchecked source SID count to compute the inherited ACE size. That could advance the temporary inherited ACE buffer pointer and ntsize accounting past the allocated buffer.
Fix this by validating the parent ACE SID count and SID length before using the SID during inheritance. Compute the inherited ACE size from the copied SID so the size matches the bounded destination SID. Reject the inherited DACL if size accumulation would overflow smbacl.size or the security descriptor allocation size.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43490?
The CVE-2026-43490 vulnerability has a medium severity rating due to potential security risks associated with improper validation of inherited ACE SID lengths.
How do I fix CVE-2026-43490?
To fix CVE-2026-43490, update the ksmbd component of the Linux kernel to the latest stable version that addresses this vulnerability.
What types of systems are affected by CVE-2026-43490?
CVE-2026-43490 affects Linux-based systems using the ksmbd component of the Linux kernel.
What functionality is impacted by CVE-2026-43490?
CVE-2026-43490 impacts the proper validation of inherited Access Control Entry (ACE) SID lengths during directory access checks.
Is CVE-2026-43490 exploitable remotely?
CVE-2026-43490 may be exploitable remotely, allowing attackers to potentially bypass security restrictions in affected systems.