The vulnerability lies in the ksmbd SMB2 SET_INFO SECURITY handler, which allows a client to re‑perm its own file descriptor by calling SMB2_SET_INFO with the security descriptor type without performing a per‑handle access check. The missing approval of a WRITE_DAC or WRITE_OWNER permission means that a handle opened only with FILE_WRITE_ATTRIBUTES can change the file’s DACL and owner, granting itself rights that should be restricted. This can be used to bypass file permissions and elevate privileges on the target system, directly affecting confidentiality, integrity, and availability for the victim. The weakness is an improper access control flaw that can lead to privilege escalation.

All Linux kernel builds that include ksmbd but lack the patch introduced by commit cc57232cae23 are affected. The vulnerability exists in kernels prior to the inclusion of the WRITE_DAC/WRITE_OWNER check in the SMB2 SET_INFO SECURITY arm. As the patch is available in the mainline kernel, systems running kernel versions before the commit are at risk.

The EPSS score for this flaw is reported as less than 1%, indicating a very low probability of active exploitation at this time. It is not listed in the CISA KEV catalog, further suggesting it is not currently a widely exploited vulnerability. However, the flaw can be exploited by an SMB2 client that can open a file with FILE_WRITE_ATTRIBUTES access, a grant that can be easily obtained on an SMB share. The attack vector is local to a network attacker who can speak SMB2 to a ksmbd instance. The potential impact is high, but the likelihood of exploitation is considered low due to the need for SMB2 communication and the absence of a public exploit. The CVSS score is 8.8, indicating the vulnerability is high severity.