CVE-2026-53390

CVE CVE-2026-53390EUVD EUVD-2026-45512Published 2026-07-19T12:01:54.000ZLast changed 2026-08-05T12:35:30.000ZCVSS 8.1

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds read in smb_check_perm_dacl() The permission-check ACE walk in smb_check_perm_dacl() validates the ACE header size and caps sid.num_subauth at SID_MAX_SUB_AUTHORITIES, but it never checks that ace->size is actually large enough to contain num_subauth sub-authorities before compare_sids() dereferences them. CIFS_SID_BASE_SIZE covers the SID header up to but excluding the sub_auth[] array, and offsetof(struct smb_ace, sid) is the ACE header, so the existing guards only guarantee the 8-byte SID base, i.e. zero sub-authorities. compare_sids() then reads ace->sid.sub_auth[i] for i < min(local_sid->num_subauth, ace->sid.num_subauth). The local comparison SIDs (sid_everyone, sid_unix_NFS_mode, and the id_to_sid() result) always have at least one sub-authority, and an attacker controls the ACE revision and authority bytes (which lie within the in-bounds SID base), so they can match one of those SIDs and force the sub_auth read. A crafted ACE with size == 16 and num_subauth >= 1 placed at the tail of the security descriptor therefore causes a heap out-of-bounds read of up to SID_MAX_SUB_AUTHORITIES * sizeof(__le32) bytes past the pntsd allocation. The security descriptor is loaded by ksmbd_vfs_get_sd_xattr() into a buffer sized exactly to the on-disk data (kzalloc(sd_size) in ndr_decode_v4_ntacl()), so the read lands past the allocation. The malformed descriptor can be stored verbatim via SMB2_SET_INFO (the DACL is not normalised before being written to the security.NTACL xattr) and the read fires on a subsequent SMB2_CREATE access check, making this reachable by an authenticated client on a share that uses ACL xattrs. Add the missing num_subauth-versus-ace_size check, mirroring the identical guards already present in the sibling parsers parse_dacl() and smb_inherit_dacl().

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 6.12.84 <6.12.95; 5.15.210 <5.15.212; 151b1799861fde38087c08f613abc2843ef597b0; 6.6.140 <6.6.144; patch: 6.1.177; patch: 6.18.38; 90089584b2e25c4510b7b987387b4405f0673ece <7627ff8c4f9919f14de562b0160ab4ec9d80b1f7; d07b26f39246a82399661936dd0c853983cfade7 <e36e35660adb9b8ef1435ac359151dda5f094c55; patch: 6.12.95; patch: 7.1.3; 95e5aa3c3261da8c95b27d7aecf8ee39b9f86a4c <d5c81a095c86fe507c032d08f3a8cfc518444927; f20adc4ef7428bc485ee83fd1a592252fb87718b <988c93d3bba066d8669143e6ec30bb2be9608d53; 282cbbb476b9f35793452bc461934af4c7eca169 <c7488c85fd822959e9b5c22fbd9e7c8a21caf5e0; 325d4ac11f526cb8964cff14548ccf02d8c756d8 <36599894fa8536fefdf1e296c0af71b8b7226859; d07b26f39246a82399661936dd0c853983cfade7 <1ef06004ed4bd6d3ed8c840d9d1a376b66d4935b; 6.18.25 <6.18.38; 7.0.2 <7.1; 6.1.176 <6.1.177; patch: 0; 7.1; patch: 7.2-rc1; patch: 6.6.144; patch: 5.15.212

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.