CVE-2026-8449
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Linux ksmbd contains a remote memory corruption vulnerability in the ACL inheritance path that allows remote clients with directory creation permissions to trigger a heap out-of-bounds read and subsequent heap corruption by setting a crafted DACL with a malformed SID containing an inflated num_subauth field. Attackers can exploit this vulnerability by creating a directory, setting the malicious DACL via SMB2_SET_INFO, and creating child entries to cause kernel instability, denial of service, or potentially achieve privilege escalation to kernel code execution.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | ksmbd | 0 <= 996454b | affected |
Weaknesses
- CWE-125: CWE-125 Out-of-bounds Read
References
- https://github.com/torvalds/linux/blob/6596a02b207886e9e00bb0161c7fd59fea53c081/fs/smb/server/smbacl.c
- https://github.com/torvalds/linux/commit/996454bc0da84d5a1dedb1a7861823087e01a7ae
- https://www.vulncheck.com/advisories/linux-ksmbd-remote-memory-corruption-via-acl-inheritance
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.