UBUNTU-CVE-2026-31706: High severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate numaces and harden ACE walk in smbinheritdacl() smbinheritdacl() trusts the on-disk numaces value from the parent directory's DACL xattr and uses it to size a heap allocation: acesbase = kmalloc(sizeof(struct smbace) numaces 2, ...); numaces is a u16 read from le16tocpu(parentpdacl->numaces) without checking that it is consistent with the declared pdaclsize. An authenticated client whose parent directory's security.NTACL is tampered (e.g. via offline xattr corruption or a concurrent path that bypasses parsedacl()) can present numaces = 65535 with minimal actual ACE data. This causes a ~8 MB allocation (not kzalloc, so uninitialized) that the subsequent loop only partially populates, and may also overflow the three-way sizet multiply on 32-bit kernels. Additionally, the ACE walk loop uses the weaker offsetof(struct smbace, accessreq) minimum size check rather than the minimum valid on-wire ACE size, and does not reject ACEs whose declared size is below the minimum. Reproduced on UML + KASAN + LOCKDEP against the real ksmbd code path. A legitimate mount.cifs client creates a parent directory over SMB (ksmbd writes a valid security.NTACL xattr), then the NTACL blob on the backing filesystem is rewritten to set numaces = 0xFFFF while keeping the posixaclhash bytes intact so ksmbdvfsgetsdxattr()'s hash check still passes. A subsequent SMB2 CREATE of a child under that parent drives smb2open() into smbinheritdacl() (share has "vfs objects = aclxattr" set), which fails the page allocator: WARNING: mm/pagealloc.c:5226 at allocfrozenpagesnoprof+0x46c/0x9c0 Workqueue: ksmbd-io handleksmbdwork allocfrozenpagesnoprof+0x46c/0x9c0 kmalloclargenode+0x68/0x130 kmalloclargenodenoprof+0x24/0x70 kmallocnoprof+0x4c9/0x690 smbinheritdacl+0x394/0x2430 smb2open+0x595d/0xabe0 handleksmbdwork+0x3d3/0x1140 With the patch applied the added guard rejects the tampered value with -EINVAL before any large allocation runs, smb2open() falls back to smb2createsdbuffer(), and the child is created with a default SD. No warning, no splat. Fix by: 1. Validating numaces against pdaclsize using the same formula applied in parsedacl(). 2. Replacing the raw kmalloc(sizeof numaces 2) with kmallocarray(numaces 2, sizeof(...)) for overflow-safe allocation. 3. Tightening the per-ACE loop guard to require the minimum valid ACE size (offsetof(smbace, sid) + CIFSSIDBASESIZE) and rejecting under-sized ACEs, matching the hardening in smbcheckpermdacl() and parsedacl(). v1 -> v2: - Replace the synthetic test-module splat in the changelog with a real-path UML + KASAN reproduction driven through mount.cifs and SMB2 CREATE; Namjae flagged the kcifs3testinheritdaclold name in v1 since it does not exist in ksmbd. - Drop the commit-hash citation from the code comment per Namjae's review; keep the parsedacl() pointer.