CVE-2026-43350

What it actually does

This flaw affects the Linux kernel SMB/CIFS client ACL parsing path. When processing a discretionary ACL returned by an SMB server, the client incorrectly treats a shortened SID as the special NFS mode SID because SID comparison only checks the minimum number of subauthorities. A malicious SMB server can return a crafted ACE with too few SID subauthorities, causing the kernel client to read four bytes past the end of the ACE while recovering mode bits. The likely technical outcomes are kernel memory corruption symptoms such as out-of-bounds read, kernel warning/oops, client crash, or system denial of service; limited confidentiality or integrity impact may be possible depending on adjacent memory contents and error handling.

Why it matters to the business

Systems that mount SMB/CIFS shares from untrusted, compromised, or attacker-controlled servers could experience kernel instability or crashes, potentially disrupting workloads, file access, desktops, or servers that rely on network shares. Because exploitation requires a Linux client to interact with a malicious SMB server or share, exposure is highest where users can mount arbitrary network shares, automount SMB paths, or access SMB resources across less-trusted networks. This issue is not currently listed in CISA KEV, has no known mature public exploit in the provided data, and has a low EPSS score, but kernel-level availability impact makes remediation important for systems using SMB mounts.

How an attack unfolds

An attacker first positions or compromises an SMB server that a vulnerable Linux system will connect to. The victim must initiate SMB/CIFS access, such as mounting a share or browsing a share through software that uses the kernel CIFS client. During ACL retrieval, the malicious server returns a crafted ACE whose SID partially matches the Linux client’s expected NFS mode SID but contains only two subauthorities instead of the three required for safe mode-bit parsing. The vulnerable kernel code accepts the partial match, then reads beyond the ACE boundary when accessing the missing third subauthority. Depending on kernel configuration, memory layout, and runtime checks, this can trigger a kernel oops, panic, CIFS mount failure, or other instability; in less common cases, adjacent memory influence or disclosure may be possible.

How to fix it

Upgrade the Linux kernel to a version that includes the fix requiring at least three SID subauthorities before treating an ACE SID as an NFS mode SID. If a distribution kernel is used, apply the vendor security update for the affected kernel package rather than relying only on upstream version numbers. No exact fixed package versions were provided in the input, so confirm the corrected kernel build through the Linux distribution advisory, changelog, or kernel commit backport notes referencing the SMB client cifsacl NFS mode SID bounds check. As interim mitigations, avoid mounting SMB/CIFS shares from untrusted servers, restrict outbound SMB traffic to approved file servers, disable or remove unnecessary CIFS automounts, and limit user ability to mount arbitrary SMB shares.

How to confirm the fix worked

Confirm remediation by verifying the running kernel version and package release match a vendor advisory that includes the SMB client fix for requiring a full NFS mode SID before reading mode bits. Reboot into the patched kernel and verify that no older vulnerable kernel remains active with `uname -a` and the distribution package manager. Where source or debug symbols are available, validate that the CIFS ACL parsing code checks the SID subauthority count before reading the NFS mode bits. Operationally, review systems for active CIFS/SMB mounts, confirm they point only to trusted servers, and monitor kernel logs after SMB mount tests for absence of CIFS ACL parsing crashes, KASAN out-of-bounds reports, kernel oopses, or panics related to `parse_dacl` or `cifsacl`.

Typical attack path

1. Attacker operates or compromises an SMB server reachable by Linux clients.
2. Attacker prepares a share or response path that causes the Linux CIFS client to request and parse ACL data.
3. A user, service, automount rule, or application causes the vulnerable Linux host to mount or access the attacker-controlled SMB share.
4. The malicious SMB server returns a crafted ACL ACE with a shortened SID that partially matches the NFS mode SID pattern.
5. The Linux kernel SMB client misclassifies the shortened SID and reads past the end of the ACE while parsing mode bits.
6. The affected client may log kernel CIFS errors, crash the mount operation, oops, panic, or become unstable, causing denial of service.

How to detect it

Look for evidence that Linux hosts mounted or attempted to access suspicious SMB/CIFS shares, especially shortly before kernel instability, reboots, or service disruption. Useful log sources include system journal logs, `/var/log/kern.log`, `/var/log/messages`, `/var/log/syslog`, audit logs for mount activity, endpoint telemetry, EDR process and network records, firewall or proxy logs for outbound TCP 445, DNS logs for file-share hostnames, and NetFlow records showing SMB connections to unusual destinations. On affected systems, search kernel logs for CIFS VFS errors, kernel oops or panic messages, KASAN out-of-bounds reports, and stack traces referencing SMB/CIFS ACL parsing functions such as `parse_dacl` or `cifsacl`. Also review `/proc/mounts`, `/etc/fstab`, systemd mount units, autofs maps, desktop file-manager activity, and shell histories for SMB paths or recently mounted shares. Since exploitation relies on a malicious server response rather than a stable client-side file artifact, detection should correlate suspicious outbound SMB connections with contemporaneous kernel crashes or CIFS ACL parsing errors.

• CIFS: VFS:
• BUG: KASAN: slab-out-of-bounds in parse_dacl
• BUG: KASAN: out-of-bounds in parse_dacl
• parse_dacl
• cifsacl
• cifs_mount
• mount.cifs
• type=cifs
• //
• tcp/445
• kernel panic
• Oops:
• general protection fault
• BUG: unable to handle kernel paging request

What your security team should do

• Inventory Linux systems that use SMB/CIFS mounts, including servers, desktops, containers with host-mounted CIFS paths, backup jobs, and automount configurations.
• Prioritize patching Linux endpoints and servers that connect to user-controlled, internet-adjacent, partner, lab, or otherwise less-trusted SMB servers.
• Apply the relevant distribution kernel security update and reboot systems into the patched kernel.
• Restrict outbound SMB/CIFS access at host firewalls, network egress controls, VPN policy, and endpoint controls to approved file servers only.
• Disable unnecessary CIFS automounts and remove configurations that allow users or applications to mount arbitrary SMB shares.
• Increase monitoring for kernel oops, panic, KASAN, and CIFS VFS errors on systems that recently accessed unfamiliar SMB shares.
• If crashes or suspicious SMB activity are observed, preserve kernel logs, mount history, shell history, system journal data, and network telemetry before rebooting or rebuilding affected systems.