CVE-2026-53390

What it actually does

This vulnerability is a Linux kernel ksmbd out-of-bounds read in the SMB ACL permission-check path. When ksmbd evaluates a discretionary access control list, smb_check_perm_dacl() validates the ACE header and caps the SID sub-authority count, but it does not verify that the ACE length is large enough to contain the declared number of SID sub-authorities. An authenticated SMB client can store a malformed NT security descriptor, for example through SMB2_SET_INFO, with a crafted ACE placed at the end of the security.NTACL extended attribute. On a later SMB2_CREATE access check, ksmbd may read past the heap allocation while comparing SIDs. The likely technical outcomes are kernel memory disclosure to the local kernel code path and/or a kernel fault leading to denial of service. The issue is network-reachable through SMB, requires authentication, does not require user interaction, and primarily affects systems using the in-kernel ksmbd server with ACL xattrs enabled.

Why it matters to the business

Organizations using Linux kernel ksmbd as an SMB file server may be exposed to remote authenticated attacks that can crash file-sharing services or potentially expose sensitive kernel memory. Operationally, exploitation could interrupt access to shared files, disrupt business applications dependent on SMB shares, and create incident-response concerns around possible information disclosure. The vulnerability is not currently listed in CISA KEV, is not reported as ransomware-associated, has low EPSS probability, and has no stated public exploit maturity in the provided data, but the bug is recent and resides in kernel attack surface reachable over the network, so internet- or broad-network-exposed SMB services should still be prioritized.

How an attack unfolds

An attacker first obtains valid SMB credentials for a share served by Linux ksmbd where NT ACLs are stored in extended attributes. The attacker then sends an SMB request that writes a crafted security descriptor, commonly through SMB2_SET_INFO, into the file or directory ACL metadata. The descriptor contains an ACE whose size is too small for the declared SID sub-authority count but whose SID base fields are arranged to pass earlier validation and match one of the comparison SIDs used during access checks. Because the malformed descriptor can be stored without normalization, it remains on disk in the security.NTACL xattr. The attacker then triggers an access check, such as by opening or creating the object with SMB2_CREATE. During permission evaluation, smb_check_perm_dacl() calls SID comparison logic that reads sub-authority fields beyond the allocated descriptor buffer. Depending on memory layout and kernel hardening, this can result in a kernel out-of-bounds read, sensitive memory exposure, a kernel warning, or a crash/panic that disrupts SMB service availability.

How to fix it

Apply the Linux kernel update that includes the ksmbd fix adding a num_subauth-versus-ACE-size validation check in smb_check_perm_dacl(). If vendor-specific fixed package versions are not yet available, track the relevant distribution kernel advisories and update to the first kernel release containing the upstream ksmbd patch. Where immediate patching is not possible, reduce exposure by disabling ksmbd if it is not required, using mature user-space Samba where appropriate, restricting SMB access to trusted networks, blocking TCP/445 from untrusted networks, requiring strong authentication, and limiting which users can modify ACLs or write NT security descriptors. Consider disabling or avoiding ksmbd ACL xattr functionality on exposed shares until patched, if operationally feasible. Reboot into the patched kernel after installation; merely installing the package is not sufficient if the vulnerable kernel remains running.

How to confirm the fix worked

Confirm whether the running kernel includes the ksmbd fix, not only whether updated packages are installed. Validate with uname -a, distribution package metadata, and vendor security advisory mapping for the running kernel build. Check whether ksmbd is loaded or active using lsmod, systemctl status where applicable, /proc/modules, and listening services on TCP/445. Confirm whether shares use ksmbd and ACL xattrs such as security.NTACL. After patching and rebooting, verify the system is running the corrected kernel version and that ksmbd continues to operate normally. In test environments only, use a benign regression test that attempts to store a malformed DACL and confirms the operation is rejected or no kernel KASAN/oops/slab out-of-bounds warning is generated during subsequent SMB2_CREATE access checks.

Typical attack path

1. Identify a Linux SMB service backed by the in-kernel ksmbd server rather than user-space Samba.
2. Authenticate to an SMB share with sufficient permissions to modify file or directory security descriptors.
3. Send an SMB2_SET_INFO request that stores a malformed NT security descriptor containing a crafted ACE with an undersized ACE length and nonzero SID sub-authority count.
4. Wait for or directly trigger an access check against the object, commonly using SMB2_CREATE/open operations.
5. Cause ksmbd to evaluate the malformed DACL in smb_check_perm_dacl().
6. Trigger an out-of-bounds heap read during SID comparison, potentially causing information disclosure, kernel warnings, or denial of service.

How to detect it

To determine whether exploitation may already have occurred, review kernel logs, system journal logs, crash dumps, and ksmbd service logs for kernel warnings or panics involving ksmbd ACL processing, SID comparison, or out-of-bounds reads. Useful sources include journalctl -k, /var/log/kern.log, /var/log/messages, /var/crash, kdump/vmcore repositories, audit logs, EDR telemetry, and network SMB telemetry where available. Look for authenticated SMB clients performing SMB2_SET_INFO operations that modify security descriptors or NT ACLs, followed by SMB2_CREATE/open requests against the same object shortly before a kernel warning, ksmbd worker crash, service interruption, or host reboot. Filesystem forensic review may include searching for suspicious or malformed security.NTACL extended attributes on shares served by ksmbd, particularly ACE records with inconsistent size and SID sub-authority count fields. Because normal SMB logs may not capture raw security descriptor contents, absence of application-level evidence does not rule out exploitation; kernel crash artifacts and packet captures are often more probative. If KASAN or hardened kernel diagnostics are enabled, prioritize any slab-out-of-bounds reports in compare_sids(), smb_check_perm_dacl(), ksmbd_vfs_get_sd_xattr(), or related ksmbd call paths.

• ksmbd
• security.NTACL
• SMB2_SET_INFO
• SMB2_CREATE
• smb_check_perm_dacl
• compare_sids
• ksmbd_vfs_get_sd_xattr
• ndr_decode_v4_ntacl
• BUG: KASAN: slab-out-of-bounds
• slab-out-of-bounds in compare_sids
• slab-out-of-bounds in smb_check_perm_dacl
• kernel BUG at fs/smb/server
• Oops:
• general protection fault
• ksmbd:
• /var/log/kern.log
• /var/log/messages
• /var/crash
• vmcore

What your security team should do

• Inventory Linux systems exposing SMB over TCP/445 and distinguish kernel ksmbd deployments from Samba deployments.
• Prioritize patching externally exposed or broadly reachable ksmbd servers, especially those allowing authenticated users to modify ACLs or security descriptors.
• Reboot systems after kernel updates and verify the running kernel contains the ksmbd fix.
• Restrict SMB access with network controls so only trusted clients and required subnets can reach ksmbd services.
• Review authentication and authorization on SMB shares; minimize accounts able to alter ACLs or write extended security metadata.
• Temporarily disable ksmbd or ACL xattr support on high-risk systems if patching cannot be completed promptly and business impact permits.
• Monitor kernel logs and SMB logs for crashes, KASAN reports, malformed ACL activity, and unusual SMB2_SET_INFO followed by SMB2_CREATE sequences.
• Treat unexplained ksmbd kernel faults or panics on file servers as potential security events and preserve logs, kernel crash dumps, and affected filesystem metadata for investigation.