The ksmbd component in the Linux kernel aggregates the sizes of POSIX and NT access control entries in unsigned 16‑bit counters. If a file contains many ACL entries the accumulated size can wrap past 65535. The subsequent pointer arithmetic then points into a region of the buffer that has already been written, causing overwrites that corrupt earlier entries and truncate the ACL size field. This integrity violation in a kernel data structure can subvert permission checks or inject malicious data, allowing an attacker to elevate privileges or execute code at kernel level.

All Linux kernel releases that include the ksmbd SMB server component are potentially affected until the patch commits are applied. The fix was introduced in commit 299f962c0b02d048fb45d248b4da493d03f3175d, so any kernel older than that is vulnerable.

An attacker with network access to a ksmbd‑enabled SMB service can send crafted ACL entries to trigger the integer overflow. Because the error occurs in kernel space, successful exploitation can lead to privilege escalation or arbitrary code execution. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog; no CVSS score was supplied, but kernel‑level impact indicates high severity. The attack requires only the ability to influence ACL creation over SMB, with no local privilege escalation prerequisite.