The vulnerability resides in the Linux kernel’s SMB server (ksmbd) where a variable‑length Security Identifier (SID) within an inherited Access Control Entry (ACE) is not fully validated. This omission can cause the comparison routine to read past the end of the ACE, leading to an out‑of‑bounds read that may expose privileged kernel memory or be leveraged for higher‑level exploitation. The flaw stems from unchecked use of sid.num_subauth to calculate the ACE size, allowing an attacker to craft a malformed inheritable ACE that advertises more subauthorities than actually exist.

All Linux kernel releases that contain the ksmbd module and have not yet applied the patch commit resolving the SID length validation bug are affected. The issue applies universally to any system running the built‑in SMB server, regardless of distribution or version, until a kernel update incorporates the fix.

No EPSS score is available and the vulnerability is not listed in CISA KEV, indicating that no public exploits have been documented at the time of analysis. Nevertheless, because the fault occurs in kernel code exercised by SMB traffic, an attacker who can influence a client’s ACL inheritance (e.g., via a specially crafted SMB packet) could trigger the out‑of‑bounds read. The potential impact includes information disclosure or escalation of privileges to kernel mode. Until a patched kernel is deployed, the risk remains significant for environments exposing SMB services.