The Linux kernel code that builds NT ACLs in the ksmbd service mismanages the size field when an integer overflow occurs. This integer overflow issue, corresponding to CWE-125, involves the helper function check_add_overflow writing the truncated sum into the destination even on overflow, and the surrounding loop breaks without restoring the correct accumulated size. The subsequent code then stores this incorrect size into the ACL structure, producing a malformed ACL whose size field under‑reports the number of bytes actually written. When such an ACL is parsed by a client or by ksmbd itself, the size mismatch can lead to out‑of‑bounds reads and memory corruption, potentially resulting in a denial of service.

The issue exists in the Linux kernel, as indicated by the CNA vendor/product entry Linux:Linux. No specific kernel version is listed in the data, so any kernel release that incorporates the ksmbd ACL code prior to the commit that restores the size on overflow is potentially affected. The fix is referenced by commit hashes such as 0bf38372821b1526f31538a7d9811844c55c7f38.

The EPSS score of 0.00168 indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, which further suggests limited public exploitation. The CVSS score of 5.9 indicates a moderate level of severity. Attackers would need to craft SMB packets containing a malformed ACL and send them to a ksmbd service or a client that parses Windows ACLs. While the exact likelihood of successful exploitation is uncertain, the potential for memory corruption and denial of service makes the risk significant, especially for unpatched systems in SMB environments.