The Linux kernel SMB client rewrites local security descriptors from ACL data supplied by remote servers, but the original validation only checked the ACL header bounds and did not verify that the number of ACEs claimed by the header matched the actual data. Because the rewrite helpers walk the ACE list based on an unverified "num_aces" field, a malicious SMB server can deliver a truncated DACL that claims additional ACEs and cause the kernel to read past the validated region while comparing or copying attacker‑controlled ACE entries. When the kernel processes these malformed ACEs, it may incorrectly grant, deny, or alter permissions on local files, effectively bypassing the client’s authorization controls. The attack therefore enables unauthorized permission modification and can lead to privilege escalation, particularly when the client owner is not expecting changes from the server. This weakness corresponds to CWE‑1288, where external input manipulates critical authorization state. The vulnerability can be exploited over the network by any SMB client that connects to a rogue or compromised SMB server. No additional local privileges are required; the attack relies solely on the client’s acceptance of the server’s response. The low EPSS score (<1%) indicates that exploitation opportunities are currently limited, but the high CVSS score (8.8) shows the potential impact if this flaw is leveraged.

All Linux systems whose kernel incorporates the SMB client but lacks the DACL validation patch are affected. The fix was introduced in kernel commits 0a8cf165566ba55a39fd0f4de172119dd646d39a and b78db9bddc84136f6a0bb49e8883cf200dfb87a8. Any Linux kernel version before these commits, regardless of distribution, is vulnerable. Distribution‑specific kernel packages older than the patched versions are also at risk.

The CVSS score of 8.8 indicates high severity, but the EPSS score is very low (<1%), showing that exploitation is unlikely at present. The vulnerability is not listed in CISA KEV. An attacker would establish an SMB session with the client and send a malformed DACL that claims one or more ACEs. The kernel then processes those ACEs, potentially rewriting local file permissions. The attack requires no additional privileges beyond being a trusted SMB server; the kernel’s SMB client will accept the connection and replay the supplied ACL. No publicly documented exploitation tool exists yet, but the code paths are present. Because the flaw allows an attacker to alter the permission state of local files, the risk is amplified if the affected system is exposed to untrusted or malicious SMB traffic. The attack vector is network‑based via SMB, and the threat is directed at systems that communicate with non‑trusted SMB servers.