The bug sits in the Linux kernel’s ksmbd SMB server. When a directory’s DACL is inherited, the code checks only the fixed SID header of each Access Control Entry (ACE) and ignores whether the variable‑length SID, described by sid.num_subauth, is fully contained inside the ACE. If a malicious ACL advertises more subauthorities than are present, the compare_sids routine may read beyond the ACE’s boundaries, producing an out‑of‑bounds read that can be leveraged for kernel‑mode privilege escalation. Additionally, smb_set_ace uses the unchecked source SID count to compute the size of the inherited ACE, potentially advancing the copy buffer pointer past the allocated region and creating a buffer overrun. This combination of unchecked length verification and unchecked buffer sizing is the root of the risk. The vulnerability is a classic unchecked length and buffer overrun issue (CWE‑787, CWE‑805). An attacker with the ability to send a specially crafted SMB packet can thus read privileged kernel data or push the kernel into a state that may allow code execution or denial of service. The flaw is not an input validation defect but a memory safety problem that gives the attacker direct access to kernel memory. The potential impact therefore extends beyond information disclosure to include privilege escalation.

All Linux kernel releases that ship the ksmbd module and have not applied the patch commit that adds SID‑length validation are at risk. The flaw is vendor‑neutral; it applies to any distribution whose kernel includes the ksmbd component, regardless of the exact version, as long as the SMB server is enabled. Systems that expose the built‑in SMB service over port 445/TCP are therefore the primary attack surface. Kernel builds that omit ksmbd or run a patched version are not affected.

The CVSS score of 8.8 reflects high severity, while the EPSS score of less than 1% indicates the current exploitation probability is very low. The vulnerability is not listed in CISA’s KEV catalog. From the description it is inferred that the attack vector is network‑based SMB traffic; an adversary must be able to send a crafted SMB packet to the target’s SMB service. If successful, the read may leak privileged data and, with further exploitation, elevate privileges or crash the kernel. Because the issue involves direct kernel memory corruption, the potential compromise is severe, even though the probability of exploitation remains low for most networks.