In the Linux kernel’s ksmbd component, a kernel function incorrectly validates the size of an Access Control Entry against the sub‑authorities encoded in its Security Identifier. The function copies the ACE without ensuring that the declared size can hold all sub‑authorities, which allows a malformed ACE to be copied and later used in a POSIX ACL deduplication walk that can read data beyond the copy boundary. This results in kernel memory corruption, potentially exposing sensitive kernel data or corrupting kernel execution flow.

All versions of the Linux kernel that contain the ksmbd service and have not yet applied the patch that validates the ACE size against the SID header are affected. The patch is identified in the kernel commit logs provided in the references, but no specific kernel release numbers are enumerated, so the vulnerability applies to every impacted system until the update is installed.

The CVSS score of 8.8 indicates a high severity vulnerability, while the EPSS score of <1% suggests a low probability of exploitation under current threat data. The vulnerability is not listed in CISA’s KEV catalog, indicating no known publicly exploited examples. The likely attack vector is remote, inferred from the fact that malicious SMB clients can send malformed ACL data to the ksmbd service over port 445 without local user interaction.