CVE-2026-90153

CVE CVE-2026-90153EUVD EUVD-2026-81746Published 2026-09-17T16:06:46.000ZLast changed 2026-09-18T17:53:28.000ZCVSS 8.1

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size smb_check_perm_dacl() validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length (acl_size) rather than the DACL's declared size (pdacl_size). When pdacl->size is smaller than the trailing NTSD buffer, bytes after the declared DACL boundary - still inside the stored security descriptor - are parsed as ACEs during access checks. A crafted DACL can place an access-granting ACE beyond pdacl->size, and the current code accepts it during SMB2_CREATE access validation, while parse_dacl() and smb_inherit_dacl() stop at pdacl_size. Bound both ACE walks by pdacl_size to match the DACL boundary semantics used elsewhere in the server. Validation: - semantic KUnit harness shows the post-boundary ACE is selected before the fix and rejected (EACCES) after it - linux master (7.2-rc6), x86_64

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux 8f0541186e9ad1b62accc9519cc2b7a7240272a7 <a29f57a14c939586d84d7fd6a029bd1fd170098f; patch: 6.18.52; patch: 7.3-rc1; 5.19.2 <5.20; 6.0; 8f0541186e9ad1b62accc9519cc2b7a7240272a7 <8e4f75e979c1d9a51b0a48ac33d0cfd5f039ec67; 8e33102309bd6839b2e2e158f93a7b378cb4655d; 5.15.62 <5.16; patch: 6.12.110; 6e8f4abf584253cbaa596ea4ad13110cf61cd4c9; 8f0541186e9ad1b62accc9519cc2b7a7240272a7 <79decd88dd3f0d42e7fb0689b1a7853bfa302459; patch: 7.2.6; cb69d4d6f709f87c94afa28ae64c501576692171; 8f0541186e9ad1b62accc9519cc2b7a7240272a7 <a4a307d149327dad5fb25187e1b03cebd1b04de6; 8f0541186e9ad1b62accc9519cc2b7a7240272a7 <a2051ffe452afad52f580b85a3fd8851933b1e7c; patch: 0; 5.18.18 <5.19; patch: 6.6.157

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.