CVE-2026-63909 (GCVE-0-2026-63909)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37
VLAI
Title
ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Commit d07b26f39246 ("ksmbd: require minimum ACE size in smb_check_perm_dacl()") introduced a transposed bounds check: if (offsetof(struct smb_ace, sid) + aces_size < CIFS_SID_BASE_SIZE) Since offsetof(..sid) is 8 and CIFS_SID_BASE_SIZE is 8, this evaluates to `aces_size < 0`. Because `aces_size` is always non-negative, this check becomes dead code and never breaks the loop. Worse, that commit removed the old 4-byte guard, meaning the loop now reads `ace->size` (offset 2) even when `aces_size` is 0-3 bytes. This re-opens a 2-byte heap out-of-bounds (OOB) read past the pntsd allocation during subsequent SMB2_CREATE operations. Fix this by properly transposing the comparison to require at least 16 bytes (8-byte offset + 8-byte SID base), matching the correct form used in smb_inherit_dacl().
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 282cbbb476b9f35793452bc461934af4c7eca169 , < 5500ba1d410aed1eded3eb04a76b10cfb4409334 (git)
Affected: f20adc4ef7428bc485ee83fd1a592252fb87718b , < f6324b4240cf0b26a84c33f68a1222d727ff4af2 (git)
Affected: 325d4ac11f526cb8964cff14548ccf02d8c756d8 , < 0fe08c5776a798f46df1fd74b331be26bdd644d6 (git)
Affected: 95e5aa3c3261da8c95b27d7aecf8ee39b9f86a4c , < d333af32e4451285e427f2d9c29de3a39f6f6d48 (git)
Affected: 90089584b2e25c4510b7b987387b4405f0673ece , < 94215d55b09445993929f4fc966061d61de74929 (git)
Affected: 151b1799861fde38087c08f613abc2843ef597b0 , < 4f7c131d2bdd7cd64b96f60d10be5ea72253f520 (git)
Affected: d07b26f39246a82399661936dd0c853983cfade7 , < 0e60dafe97eca61721f3db456f97d97a80c6c8ae (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6.140 , < 6.6.143 (semver)
Affected: 6.12.84 , < 6.12.93 (semver)
Affected: 6.18.25 , < 6.18.35 (semver)
Affected: 7.0.2 , < 7.0.12 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smbacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5500ba1d410aed1eded3eb04a76b10cfb4409334",
              "status": "affected",
              "version": "282cbbb476b9f35793452bc461934af4c7eca169",
              "versionType": "git"
            },
            {
              "lessThan": "f6324b4240cf0b26a84c33f68a1222d727ff4af2",
              "status": "affected",
              "version": "f20adc4ef7428bc485ee83fd1a592252fb87718b",
              "versionType": "git"
            },
            {
              "lessThan": "0fe08c5776a798f46df1fd74b331be26bdd644d6",
              "status": "affected",
              "version": "325d4ac11f526cb8964cff14548ccf02d8c756d8",
              "versionType": "git"
            },
            {
              "lessThan": "d333af32e4451285e427f2d9c29de3a39f6f6d48",
              "status": "affected",
              "version": "95e5aa3c3261da8c95b27d7aecf8ee39b9f86a4c",
              "versionType": "git"
            },
            {
              "lessThan": "94215d55b09445993929f4fc966061d61de74929",
              "status": "affected",
              "version": "90089584b2e25c4510b7b987387b4405f0673ece",
              "versionType": "git"
            },
            {
              "lessThan": "4f7c131d2bdd7cd64b96f60d10be5ea72253f520",
              "status": "affected",
              "version": "151b1799861fde38087c08f613abc2843ef597b0",
              "versionType": "git"
            },
            {
              "lessThan": "0e60dafe97eca61721f3db456f97d97a80c6c8ae",
              "status": "affected",
              "version": "d07b26f39246a82399661936dd0c853983cfade7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smbacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.6.143",
              "status": "affected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.93",
              "status": "affected",
              "version": "6.12.84",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.35",
              "status": "affected",
              "version": "6.18.25",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.12",
              "status": "affected",
              "version": "7.0.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "6.6.140",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.12.84",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.18.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "7.0.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops\n\nCommit d07b26f39246 (\"ksmbd: require minimum ACE size in\nsmb_check_perm_dacl()\") introduced a transposed bounds check:\n\n    if (offsetof(struct smb_ace, sid) + aces_size \u003c CIFS_SID_BASE_SIZE)\n\nSince offsetof(..sid) is 8 and CIFS_SID_BASE_SIZE is 8, this evaluates\nto `aces_size \u003c 0`. Because `aces_size` is always non-negative, this\ncheck becomes dead code and never breaks the loop.\n\nWorse, that commit removed the old 4-byte guard, meaning the loop now\nreads `ace-\u003esize` (offset 2) even when `aces_size` is 0-3 bytes. This\nre-opens a 2-byte heap out-of-bounds (OOB) read past the pntsd allocation\nduring subsequent SMB2_CREATE operations.\n\nFix this by properly transposing the comparison to require at least\n16 bytes (8-byte offset + 8-byte SID base), matching the correct form\nused in smb_inherit_dacl()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reachable through ksmbd\u0027s in-kernel SMB server on TCP port 445; a remote attacker sends crafted SMB2 packets that traverse the normal network receive path to smb_check_perm_dacl().\nAC:L - The attacker fully controls the crafted NTSD/DACL planted via SMB and the subsequent SMB2_CREATE that triggers the walk; no race or victim-specific memory layout is required beyond standard heap behavior.\nPR:L - Exploitation requires an authenticated SMB2 session (post SESSION_SETUP and TREE_CONNECT) with permission to create files and set security descriptors (WRITE_DAC) on a share with ACL xattr support; this is a low-privileged authenticated user, not an unauthenticated attacker.\nUI:N - No end-user interaction is required beyond the attacker operating their own SMB client against an exposed ksmbd server.\nS:U - The vulnerability is a kernel heap out-of-bounds read within ksmbd\u0027s own security context; it does not cross a VM, sandbox, or IOMMU security boundary.\nC:H - The bug is an out-of-bounds heap read of ace-\u003esize past the pntsd kmalloc allocation; per kernel guidance OOB reads warrant High confidentiality impact as adjacent heap metadata or pointers may be disclosed.\nI:N - This is a read-only out-of-bounds access with no memory write, type confusion, or demonstrated ability to modify kernel data or achieve code execution through the corrupted read path.\nA:H - Reading beyond the kmalloc boundary can trigger a kernel page fault, oops, or panic; the original fix commit also notes KASAN reports and possible kernel state corruption from the OOB access."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:02.949Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5500ba1d410aed1eded3eb04a76b10cfb4409334"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6324b4240cf0b26a84c33f68a1222d727ff4af2"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fe08c5776a798f46df1fd74b331be26bdd644d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/d333af32e4451285e427f2d9c29de3a39f6f6d48"
        },
        {
          "url": "https://git.kernel.org/stable/c/94215d55b09445993929f4fc966061d61de74929"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f7c131d2bdd7cd64b96f60d10be5ea72253f520"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e60dafe97eca61721f3db456f97d97a80c6c8ae"
        }
      ],
      "title": "ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63909",
    "datePublished": "2026-07-19T14:55:15.060Z",
    "dateReserved": "2026-07-19T07:54:57.020Z",
    "dateUpdated": "2026-08-05T12:37:02.949Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63909",
      "date": "2026-09-21",
      "epss": "0.00628",
      "percentile": "0.48425"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/smbacl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5500ba1d410aed1eded3eb04a76b10cfb4409334",
                    "status": "affected",
                    "version": "282cbbb476b9f35793452bc461934af4c7eca169",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f6324b4240cf0b26a84c33f68a1222d727ff4af2",
                    "status": "affected",
                    "version": "f20adc4ef7428bc485ee83fd1a592252fb87718b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0fe08c5776a798f46df1fd74b331be26bdd644d6",
                    "status": "affected",
                    "version": "325d4ac11f526cb8964cff14548ccf02d8c756d8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d333af32e4451285e427f2d9c29de3a39f6f6d48",
                    "status": "affected",
                    "version": "95e5aa3c3261da8c95b27d7aecf8ee39b9f86a4c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "94215d55b09445993929f4fc966061d61de74929",
                    "status": "affected",
                    "version": "90089584b2e25c4510b7b987387b4405f0673ece",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4f7c131d2bdd7cd64b96f60d10be5ea72253f520",
                    "status": "affected",
                    "version": "151b1799861fde38087c08f613abc2843ef597b0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0e60dafe97eca61721f3db456f97d97a80c6c8ae",
                    "status": "affected",
                    "version": "d07b26f39246a82399661936dd0c853983cfade7",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/smbacl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6.6.143",
                    "status": "affected",
                    "version": "6.6.140",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12.93",
                    "status": "affected",
                    "version": "6.12.84",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.18.35",
                    "status": "affected",
                    "version": "6.18.25",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "7.0.12",
                    "status": "affected",
                    "version": "7.0.2",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops\n\nCommit d07b26f39246 (\"ksmbd: require minimum ACE size in\nsmb_check_perm_dacl()\") introduced a transposed bounds check:\n\n    if (offsetof(struct smb_ace, sid) + aces_size \u003c CIFS_SID_BASE_SIZE)\n\nSince offsetof(..sid) is 8 and CIFS_SID_BASE_SIZE is 8, this evaluates\nto `aces_size \u003c 0`. Because `aces_size` is always non-negative, this\ncheck becomes dead code and never breaks the loop.\n\nWorse, that commit removed the old 4-byte guard, meaning the loop now\nreads `ace-\u003esize` (offset 2) even when `aces_size` is 0-3 bytes. This\nre-opens a 2-byte heap out-of-bounds (OOB) read past the pntsd allocation\nduring subsequent SMB2_CREATE operations.\n\nFix this by properly transposing the comparison to require at least\n16 bytes (8-byte offset + 8-byte SID base), matching the correct form\nused in smb_inherit_dacl()."
          }
        ],
        "id": "CVE-2026-63909",
        "lastModified": "2026-07-27T17:44:23.777",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:08.747",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0e60dafe97eca61721f3db456f97d97a80c6c8ae"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0fe08c5776a798f46df1fd74b331be26bdd644d6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4f7c131d2bdd7cd64b96f60d10be5ea72253f520"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5500ba1d410aed1eded3eb04a76b10cfb4409334"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/94215d55b09445993929f4fc966061d61de74929"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d333af32e4451285e427f2d9c29de3a39f6f6d48"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f6324b4240cf0b26a84c33f68a1222d727ff4af2"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-21T11:37:13+00:00",
      "cve": "CVE-2026-63909",
      "id": "CVE-2026-63909",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "275",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63909.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-30T16:35:22Z",
      "cve": "CVE-2026-63909",
      "id": "CVE-2026-63909",
      "initial_release_date": "2026-07-21T13:03:47Z",
      "product_status:known_not_affected": "298",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63909",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63909.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.