Cloudanix VulnDB

CVE-2026-63909

High · 8.1

CVSS

8.1

EPSS

0.6%

Published

Jul 19, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A small coding mistake in Linux file-sharing software could let an attacker peek at a couple of extra bytes of memory, but the flaw is difficult to exploit and has not been seen in attacks.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Faulty bounds check in ksmbd's smb_check_perm_dacl allows 2-byte heap out-of-bounds read when walking ACE structures with aces_size under 4 bytes during SMB2_CREATE permission evaluation.

Why it matters to the business

Linux servers exposing SMB shares via ksmbd face limited risk of memory disclosure or service instability; low exploit probability means minimal immediate operational disruption but still requires patching to maintain secure file-sharing posture.

How an attack unfolds

An attacker authenticates to a ksmbd instance and issues an SMB2 CREATE request containing a pntsd buffer with an undersized ACE list; the transposed check fails to terminate the loop, causing the kernel to read ace->size two bytes beyond the allocation.

How to fix it

Apply the upstream fix that restores a correct minimum-size check requiring at least 16 bytes before the ACE walk; rebuild and deploy the patched kernel on all systems running ksmbd.

How to confirm the fix worked

Inspect the smb_check_perm_dacl function for the corrected comparison (offsetof(struct smb_ace, sid) + aces_size >= CIFS_SID_BASE_SIZE) and confirm the old dead-code check is removed; test with crafted packets that previously triggered the OOB condition.

Typical attack path

  1. Establish SMB2 session to target ksmbd
  2. Craft pntsd with aces_size 0-3 bytes
  3. Issue SMB2 CREATE containing the malformed security descriptor
  4. Trigger smb_check_perm_dacl during ACL evaluation
  5. Observe 2-byte OOB read in subsequent processing

How to detect it

Review kernel logs for oops or warnings referencing smb_check_perm_dacl or ACE parsing; inspect SMB2 CREATE requests containing unusually small security descriptors in network captures.

What your security team should do

  • Prioritize kernel updates containing the bounds-check correction within standard patch cycles
  • Disable ksmbd on systems that do not require kernel-mode SMB serving
  • Monitor EPSS and exploit maturity indicators for any future increase

The record

In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Commit d07b26f39246 ("ksmbd: require minimum ACE size in smb_check_perm_dacl()") introduced a transposed bounds check: if (offsetof(struct smb_ace, sid) + aces_size < CIFS_SID_BASE_SIZE) Since offsetof(..sid) is 8 and CIFS_SID_BASE_SIZE is 8, this evaluates to `aces_size < 0`. Because `aces_size` is always non-negative, this check becomes dead code and never breaks the loop. Worse, that commit removed the old 4-byte guard, meaning the loop now reads `ace->size` (offset 2) even when `aces_size` is 0-3 bytes. This re-opens a 2-byte heap out-of-bounds (OOB) read past the pntsd allocation during subsequent SMB2_CREATE operations. Fix this by properly transposing the comparison to require at least 16 bytes (8-byte offset + 8-byte SID base), matching the correct form used in smb_inherit_dacl().

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities