The ksmbd module in the Linux kernel had an input validation flaw where the size of an ACE was not fully checked against the contained SID sub‑authorities. An undersized ACE could be copied, and later during a POSIX ACL deduplication walk, the kernel would read data past the copied ACE boundary. This memory corruption could be exploited to gain code execution in kernel context or do denial of service. The flaw arises when incorrectly formatted SMB ACL data is processed by a running ksmbd service.

The issue applies to the Linux kernel’s ksmbd component in all released versions prior to the documented fix. No specific version list is supplied, so any kernel that includes ksmbd and does not contain the later patch is potentially affected.

Because the vulnerability results in a kernel buffer overflow, the risk is high. The EPSS score is not available, but the CVE is not listed in the CISA KEV catalogue, suggesting no known active exploitation. An attacker would need the ability to send malicious SMB ACL descriptors to the target, implying a remote attack vector. Proper patching removes the vulnerability and eliminates the kernel memory corruption path.