CVE-2026-90153

Status: UPDATED  |  Advisory ID: CVE-2026-90153

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size

smb_check_perm_dacl() validates that the DACL fits inside the NT

security descriptor, but then bounds its two ACE walks by the

remaining NTSD length (acl_size) rather than the DACL's declared

size (pdacl_size).

When pdacl->size is smaller than the trailing NTSD buffer, bytes

after the declared DACL boundary - still inside the stored security

descriptor - are parsed as ACEs during access checks. A crafted

DACL can place an access-granting ACE beyond pdacl->size, and the

current code accepts it during SMB2_CREATE access validation, while

parse_dacl() and smb_inherit_dacl() stop at pdacl_size.

Bound both ACE walks by pdacl_size to match the DACL boundary

semantics used elsewhere in the server.

Validation:

- semantic KUnit harness shows the post-boundary ACE is selected

before the fix and rejected (EACCES) after it

- linux master (7.2-rc6), x86_64 (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References