The ksmbd component of the Linux kernel incorrectly processes the sub‑authority array of a Security Identifier (SID) when parsing Access Control Lists. If a SID contains only two sub‑authorities but matches the pattern S‑1‑5‑88‑3, the kernel reads sub_auth[2] beyond the allocated array. These out‑of‑bounds bytes are masked to the low nine bits and applied as the file’s POSIX mode. In effect, a client can cause the server to set arbitrary read, write, or execute permissions on files exposed via SMB, allowing privilege manipulation on shared resources. The flaw is a classic out-of-bounds read (CWE‑1285) that could lead to unintended permission changes.

Affected systems are all releases of the Linux kernel that include the ksmbd subsystem and have not yet incorporated the commit that enforces a three‑sub‑authority requirement. No specific version numbers are listed in the advisory, so the risk applies to any kernel build where the vulnerability remains unpatched. The advisory lists only the generic vendor product “Linux:Linux”, indicating the issue is kernel‑wide rather than restricted to a particular distribution.

The vulnerability receives a CVSS score of 8.6, indicating high potential impact, while the EPSS score of under 1 percent shows a low probability of widespread exploitation at present. The attack vector is most likely remote, originating from a malicious SMB client that crafts a specially formatted ACL entry; the exploitation requires the client to supply a SID with two sub‑authorities matching the pattern S‑1‑5‑88‑3 and to place the entry at the end of the descriptor. The issue is not currently listed in CISA’s KEV catalog, which suggests no confirmed, active exploitation.