The Linux kernel code that builds NT ACLs in the ksmbd service mismanages the size field when an integer overflow occurs. The helper function check_add_overflow writes the truncated sum into the destination even on overflow, and the surrounding loop breaks without restoring the correct accumulated size. The subsequent code then stores this incorrect size into the ACL structure, producing a malformed ACL whose size field under‑reports the number of bytes actually written. When such an ACL is parsed by a client or by ksmbd itself, the size mismatch can lead to out‑of‑bounds reads and memory corruption, potentially resulting in a denial of service.

The issue exists in the Linux kernel, as indicated by the CNA vendor/product entry Linux:Linux. No specific kernel version is listed in the data, so any kernel release that incorporates the ksmbd ACL code prior to the commit that restores the size on overflow is potentially affected. The fix is referenced by commit hashes such as 0bf38372821b1526f31538a7d9811844c55c7f38.

No EPSS score is available and the vulnerability is not in CISA’s KEV list, indicating that there is limited public exploitation evidence at the time of this assessment. The CVSS score is not provided, but the flaw involves an integer overflow that directly corrupts a size field used during network traffic parsing. Attackers would need to send crafted SMB packets containing a malformed ACL to a ksmbd service or to a client that parses Windows ACLs. While the exact likelihood of successful exploitation is uncertain, the potential for memory corruption and denial of service makes the risk significant, especially for unpatched systems exposed to SMB environments.