The flaw resides in the Linux kernel’s SMB server (ksmbd). When inheriting access-control lists, the code loads a parent directory’s DACL from a security-descriptor attribute and verifies only the fixed SID header of each ACE. It does not validate that the variable-length SID, as indicated by sid.num_subauth, is fully contained within the ACE. Consequently, a malformed inheritable ACE that advertises more sub-authorities than actually exist can cause the comparison routine to read beyond the ACE’s boundary, leading to an out-of-bounds read of kernel memory. This read can expose privileged data or potentially be leveraged for kernel-mode privilege escalation.

All Linux kernel releases that ship the ksmbd module and have not incorporated the patch commit that adds SID-length validation are affected. The issue is independent of distribution and applies to any system exposing the built-in SMB server, regardless of vendor or version, until the kernel update is applied.

The vulnerability has a CVSS score of 8.8, indicating high severity, and an EPSS score of less than 1%, showing a very low current likelihood of exploitation. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker who can send a specially crafted SMB packet could trigger the out-of-bounds read. The impact could include information disclosure or, in the worst case, privilege escalation to kernel mode. Until the patch is deployed, the risk remains significant for environments that expose SMB services.