CVE-2026-63909

CVE CVE-2026-63909EUVD EUVD-2026-45682Published 2026-07-19T14:55:15.000ZLast changed 2026-08-05T12:37:02.000ZCVSS 8.1

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Commit d07b26f39246 ("ksmbd: require minimum ACE size in smb_check_perm_dacl()") introduced a transposed bounds check: if (offsetof(struct smb_ace, sid) + aces_size < CIFS_SID_BASE_SIZE) Since offsetof(..sid) is 8 and CIFS_SID_BASE_SIZE is 8, this evaluates to `aces_size < 0`. Because `aces_size` is always non-negative, this check becomes dead code and never breaks the loop. Worse, that commit removed the old 4-byte guard, meaning the loop now reads `ace->size` (offset 2) even when `aces_size` is 0-3 bytes. This re-opens a 2-byte heap out-of-bounds (OOB) read past the pntsd allocation during subsequent SMB2_CREATE operations. Fix this by properly transposing the comparison to require at least 16 bytes (8-byte offset + 8-byte SID base), matching the correct form used in smb_inherit_dacl().

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 90089584b2e25c4510b7b987387b4405f0673ece <94215d55b09445993929f4fc966061d61de74929; 6.6.140 <6.6.143; f20adc4ef7428bc485ee83fd1a592252fb87718b <f6324b4240cf0b26a84c33f68a1222d727ff4af2; 282cbbb476b9f35793452bc461934af4c7eca169 <5500ba1d410aed1eded3eb04a76b10cfb4409334; 325d4ac11f526cb8964cff14548ccf02d8c756d8 <0fe08c5776a798f46df1fd74b331be26bdd644d6; 6.12.84 <6.12.93; d07b26f39246a82399661936dd0c853983cfade7 <0e60dafe97eca61721f3db456f97d97a80c6c8ae; 7.0.2 <7.0.12; 151b1799861fde38087c08f613abc2843ef597b0 <4f7c131d2bdd7cd64b96f60d10be5ea72253f520; 6.18.25 <6.18.35; 95e5aa3c3261da8c95b27d7aecf8ee39b9f86a4c <d333af32e4451285e427f2d9c29de3a39f6f6d48

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.