CVE-2026-43490

HIGH EPSS 32.6%
Published May 15, 20261mo ago · Modified Jun 26, 20263d ago
8.8 CVSS 3.1
High
Find Similar
Published May 15, 2026 1mo ago
Last Modified Jun 26, 2026 3d ago

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate inherited ACE SID length smb_inherit_dacl() walks the parent directory DACL loaded from the security descriptor xattr. It verifies that each ACE contains the fixed SID header before using it, but does not verify that the variable-length SID described by sid.num_subauth is fully contained in the ACE. A malformed inheritable ACE can advertise more subauthorities than are present in the ACE. compare_sids() may then read past the ACE. smb_set_ace() also clamps the copied destination SID, but used the unchecked source SID count to compute the inherited ACE size. That could advance the temporary inherited ACE buffer pointer and nt_size accounting past the allocated buffer. Fix this by validating the parent ACE SID count and SID length before using the SID during inheritance. Compute the inherited ACE size from the copied SID so the size matches the bounded destination SID. Reject the inherited DACL if size accumulation would overflow smb_acl.size or the security descriptor allocation size.

CVSS Details

Base Score
8.8
Exploitability
2.8
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
32.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-787 Out-of-bounds Write Memory Safety

Affected Products 6

VendorProductVersionRange
linuxlinux_kernel*≥5.15  –  <6.6.141
linuxlinux_kernel*≥6.7  –  <6.12.88
linuxlinux_kernel*≥6.13  –  <6.18.30
linuxlinux_kernel*≥6.19  –  <7.0.7
linuxlinux_kernel7.1any
linuxlinux_kernel7.1any

References 5

  • git.kernel.org https://git.kernel.org/stable/c/1aa60fea7f637c071f529ad6784aecca2f2f0c5f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/47c6e37a77b10e74f70d845ba4ea5d3cafa00336
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/996454bc0da84d5a1dedb1a7861823087e01a7ae
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a7fb771314fb3a265d30f8ac245869a367ab065c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c1d95c995d5bcb24b639200a899eda59cb1e6d64
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/1aa60fea7f637c071f529ad6784aecca2f2f0c5f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/47c6e37a77b10e74f70d845ba4ea5d3cafa00336
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/996454bc0da84d5a1dedb1a7861823087e01a7ae
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a7fb771314fb3a265d30f8ac245869a367ab065c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c1d95c995d5bcb24b639200a899eda59cb1e6d64
    Patch