CVE-2026-43490

What it actually does

This is a Linux kernel memory-corruption flaw in ksmbd, the in-kernel SMB server. When ksmbd inherits access control entries from a parent directory security descriptor, it validates that an ACE contains a basic SID header but fails to verify that the full variable-length SID is actually present. A malformed inheritable ACE can cause out-of-bounds reads during SID comparison and can corrupt size accounting while building an inherited ACL, potentially advancing an internal buffer pointer beyond the allocated buffer. Because this occurs in kernel context and is reachable over SMB by a low-privileged authenticated user, successful exploitation can lead to kernel crash, denial of service, information exposure, or potentially arbitrary kernel memory corruption with full system compromise.

Why it matters to the business

Systems exposing ksmbd-based SMB file sharing could be crashed or potentially taken over by an authenticated attacker with network access to the SMB service. The most immediate operational risk is file-sharing downtime and unplanned server reboots; the higher-impact risk is attacker escalation from a low-privileged SMB account to control of the underlying Linux host. This issue is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has a low EPSS score, but the CVSS severity is high because exploitation affects confidentiality, integrity, and availability at the kernel level.

How an attack unfolds

An attacker first obtains valid SMB credentials or access to an account that can modify directory permissions or otherwise influence inherited security descriptors on a ksmbd-backed share. The attacker places or causes a malformed inheritable ACE in a parent directory DACL where the SID subauthority count claims more SID data than the ACE actually contains. When ksmbd later processes inheritance for a child file or directory, smb_inherit_dacl() walks the parent DACL and uses the malformed SID without validating that the entire SID fits inside the ACE. This can make compare_sids() read beyond the ACE and can cause smb_set_ace() to compute inherited ACE sizes from unchecked source SID metadata, corrupting temporary ACL buffer accounting. Depending on kernel configuration, allocator state, and exploit reliability, the result may be a kernel warning, SMB service failure, system panic, memory disclosure, or kernel memory corruption that could be shaped into privilege escalation or code execution.

How to fix it

Update the Linux kernel to a vendor release that includes the ksmbd fix validating inherited ACE SID length and inherited DACL size accumulation. No exact fixed package versions were provided in the input, so use distribution advisories and kernel changelogs for CVE-2026-43490 or the ksmbd change titled "validate inherited ACE SID length." If immediate patching is not possible, disable ksmbd if it is not required, remove the ksmbd kernel module where feasible, or replace exposure with a patched user-space SMB service. Restrict TCP/445 to trusted networks, require strong authentication, limit write and permission-management rights on SMB shares, and monitor or block untrusted clients from modifying security descriptors. Because this is kernel attack surface, mitigations should be considered temporary; patching or disabling ksmbd is the primary remediation.

How to confirm the fix worked

Confirm whether the host is exposed by checking for ksmbd usage, loaded ksmbd kernel modules, active SMB listeners on TCP/445, and kernel builds containing the relevant upstream or distribution fix. Validate remediation by comparing the installed kernel package against the vendor advisory for this CVE or by confirming the ksmbd patch that validates parent ACE SID count/SID length before inheritance is present in the source or backport changelog. After patching, reboot into the fixed kernel and verify the old vulnerable kernel is not still running. For mitigation validation, confirm ksmbd is disabled or unreachable from untrusted networks and that SMB share permissions prevent ordinary users from modifying directory security descriptors where not required. Avoid validating with weaponized malformed ACLs in production; use vendor test cases or a controlled lab if functional proof is needed.

Typical attack path

1. Identify a Linux host exposing SMB over TCP/445 using ksmbd rather than Samba user-space smbd.
2. Authenticate to the SMB service with a low-privileged account that can create directories/files or alter permissions on a writable share.
3. Create or modify a parent directory security descriptor so it contains an inheritable ACE with an inconsistent SID subauthority count and truncated SID data.
4. Trigger ACL inheritance by creating or modifying a child object under that parent directory.
5. Cause ksmbd to parse the malformed inherited DACL in kernel context.
6. Exploit the resulting out-of-bounds read or buffer accounting corruption to crash the host, disrupt SMB service, or attempt kernel-level compromise.

How to detect it

To determine whether this was already exploited, review kernel logs, system journals, crash dumps, SMB audit logs, and file/share permission-change history around ksmbd activity. Focus on sequences where an authenticated SMB user modified permissions or security descriptors on a directory and then created or modified child files/directories shortly before a kernel oops, panic, reboot, or ksmbd failure. In kernel logs, look for ksmbd stack traces involving ACL inheritance, SID comparison, security descriptor parsing, out-of-bounds reads, slab corruption, KASAN reports, or general protection faults. In file-system forensics, inspect ksmbd share paths for NT security descriptor extended attributes containing malformed ACE/SID length relationships, especially on parent directories with inheritable ACLs. In network telemetry, look for SMB2 SET_INFO or security descriptor update operations followed by create/open operations from the same authenticated client. Absence of these artifacts does not prove non-exploitation because a successful kernel memory corruption attempt may only leave a crash, reboot, or no durable logs.

• ksmbd
• smb_inherit_dacl
• compare_sids
• smb_set_ace
• system.nt_sec_desc
• SMB2_SET_INFO
• security descriptor
• malformed SID
• slab-out-of-bounds
• out-of-bounds read
• general protection fault
• kernel BUG
• BUG: KASAN
• KASAN: slab-out-of-bounds
• Oops:
• Kernel panic
• ksmbd.mountd
• TCP/445

What your security team should do

• Inventory Linux systems exposing SMB over TCP/445 and distinguish ksmbd from Samba smbd deployments.
• Prioritize patching or disabling ksmbd on internet-facing, cross-zone, or multi-user file-sharing systems, even though KEV and ransomware flags are currently negative.
• Apply the latest distribution kernel security update that includes the ksmbd inherited ACE SID-length validation fix, then reboot into the fixed kernel.
• Restrict SMB access to trusted networks and authenticated users; block TCP/445 from the internet and from unnecessary internal segments.
• Review SMB share ACLs so low-privileged users cannot modify directory security descriptors unless explicitly required.
• Enable kernel crash, oops, and audit logging for SMB servers and centralize logs for post-exploitation review.
• Search for malformed or suspicious NT security descriptor extended attributes on ksmbd-backed shares if exploitation is suspected.
• Treat unexplained ksmbd-related kernel panics after SMB permission changes or file creation as potential exploitation and preserve memory/crash dumps where possible.