This vulnerability in the Linux kernel’s ksmbd module arises because the smb_inherit_dacl() function trusts an unvalidated num_aces value from a parent directory’s DACL xattr and uses it to size a heap allocation. Without confirming the value against the declared pdacl_size, a tampered num_aces can be set to 65535, causing the code to allocate roughly 8 MB of uninitialized memory and, on 32‑bit kernels, potentially overflow a size_t multiply. The routine also walks the ACE list using a weak minimum‑size guard, allowing under‑sized or malicious ACE entries to be processed. An attacker with authenticated access to the SMB share can exploit this by corrupting the ntacl blob or bypassing the normal parse_dacl() path, resulting in memory‑allocation failures or kernel panics that can lead to denial of service. If the memory allocation succeeds but is mis‑aligned, the loop may overflow the buffer, leading to possible kernel corruption.

The flaw touches the Linux kernel itself, specifically the ksmbd SMB server implementation that supports ACL XATTRs (vfs objects = acl_xattr). It therefore impacts any system running a kernel that includes ksmbd and has SMB shares enabled, regardless of distribution. The vulnerability does not list a specific kernel version, so all kernels that contain the unpatched ksmbd code are potentially affected until a kernel release incorporates the described fix.

Because the exploit requires an authenticated SMB client that can manipulate the parent directory’s security.NTACL, it is not a publicly available blind attack. However, an attacker who can gain such access— for example by controlling or sniffing SMB traffic to the target or by uploading a malicious directory structure—could trigger the oversized allocation and cause a kernel OOM kill or a crash. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a moderate but non‑negligible risk. The lack of a defensive guard in recent kernels and the ability to supply an oversized num_aces value make this path relatively straightforward once the prerequisite of ACL tampering is met.