CVE-2026-53390: ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix out-of-bounds read in smbcheckpermdacl()
The permission-check ACE walk in smbcheckpermdacl() validates the ACE header size and caps sid.numsubauth at SIDMAXSUBAUTHORITIES, but it never checks that ace->size is actually large enough to contain numsubauth sub-authorities before comparesids() dereferences them.
CIFSSIDBASESIZE covers the SID header up to but excluding the subauth[] array, and offsetof(struct smbace, sid) is the ACE header, so the existing guards only guarantee the 8-byte SID base, i.e. zero sub-authorities. comparesids() then reads ace->sid.subauth[i] for i < min(localsid->numsubauth, ace->sid.numsubauth). The local comparison SIDs (sideveryone, sidunixNFSmode, and the idtosid() result) always have at least one sub-authority, and an attacker controls the ACE revision and authority bytes (which lie within the in-bounds SID base), so they can match one of those SIDs and force the subauth read.
A crafted ACE with size == 16 and numsubauth >= 1 placed at the tail of the security descriptor therefore causes a heap out-of-bounds read of up to SIDMAXSUBAUTHORITIES sizeof(le32) bytes past the pntsd allocation. The security descriptor is loaded by ksmbdvfsgetsdxattr() into a buffer sized exactly to the on-disk data (kzalloc(sdsize) in ndrdecodev4ntacl()), so the read lands past the allocation. The malformed descriptor can be stored verbatim via SMB2SETINFO (the DACL is not normalised before being written to the security.NTACL xattr) and the read fires on a subsequent SMB2CREATE access check, making this reachable by an authenticated client on a share that uses ACL xattrs.
Add the missing numsubauth-versus-acesize check, mirroring the identical guards already present in the sibling parsers parsedacl() and smbinheritdacl().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (ksmbd)to a version that resolves this vulnerability.Patch ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's ksmbd SMB server component are exposed when they process SMB security descriptors containing attacker-controlled access control entries. The issue is in permission checking for DACL ACEs, not in a client-side SMB parser.
What does an attacker need to trigger the out-of-bounds read?
An attacker needs the ability to supply a crafted ACE in a security descriptor processed by ksmbd. The ACE can declare one or more SID sub-authorities while being too small to contain them; matching the attacker-controlled SID revision and authority to a locally compared SID can cause the invalid sub-authority access.
How can I determine whether an attempted trigger is present?
Look for ksmbd processing security descriptors with ACEs at the end of the descriptor whose size is 16 bytes while their SID num_subauth value is at least 1. Such an ACE lacks space for the declared sub-authority array and can cause a heap out-of-bounds read during DACL permission checks.