The Linux kernel’s ksmbd SMB server component calculates the size of access control entries in unsigned 16‑bit counters. When a file contains many POSIX or NT ACL entries, the accumulated size can wrap beyond 65535, causing pointer arithmetic to address memory inside an already‑written block. The subsequent writes overwrite earlier entries and truncate the ACL size field, resulting in corruption of kernel data structures that hold permissions. The weakness is identified as an integer overflow (CWE‑190).

All Linux kernels that include the ksmbd service are potentially affected until the fix is applied. The vulnerability was addressed with commit 299f962c0b02d048fb45d248b4da493d03f3175d; any kernel version prior to that commit is vulnerable.

An attacker who can control ACL entries sent over SMB can trigger this overflow. Successful exploitation could corrupt kernel memory, potentially undermining access checks. The CVSS score of 5.5 indicates medium severity, the EPSS score of less than 1% suggests a low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. The attack requires only network access to a ksmbd‑enabled SMB service and does not rely on local privilege escalation prerequisites.