The Linux kernel’s ksmbd component contains an integer underflow flaw in how it validates the DACL size field of a security descriptor. The DACL size is a 16‑bit value, but the subtraction of the ACL header size uses an unsigned expression. When the size field is smaller than the header, the subtraction underflows to a very large integer, enabling the caller to dictate an excessively large number of ACEs. A malicious SMB client can trigger this path through the SMB2_SET_INFO (InfoType=SMB2_O_INFO_SECURITY) operation, causing the kernel to allocate a huge temporary ACL state and pointer array. The resulting out‑of‑bounds allocation may corrupt memory, crash the kernel, or, if successfully exploited, provide a foothold for remote code execution. The patch adds a pre‑check that rejects DACLs smaller than the ACL header before performing the arithmetic, preventing the over‑allocation from occurring.

The vulnerability affects all programs using the Linux kernel’s ksmbd SMB server. The affected product is the Linux kernel (Linux: Linux). No specific kernel revisions are listed, so any version up to the point when the patch was introduced may be vulnerable. All variants of the Linux distribution that ship a version of the kernel lacking the ksmbd DACL size validation are potentially impacted.

The CVSS score is 8.8, indicating a high severity, and the EPSS score is less than 1 %. The vulnerability is not currently listed in CISA’s Known Exploited Vulnerabilities catalog. Nevertheless, the exploit requires only that an SMB client be able to send a malformed SMB2_SET_INFO packet to the target, which can be achieved over the network from an unauthenticated or authenticated client. Because the kernel allocates large temporary buffers, an attacker is likely to cause a denial of service; if successful exploitation of the memory corruption leads to privilege escalation, arbitrary code execution becomes possible. The high CVSS score confirms the potential impact for exposed SMB services.