Linux ksmbd contains a remote memory corruption flaw that occurs when a remote client creates a directory and sets a malicious DACL with a malformed SID. The crafted SID expands the num_subauth field, causing a heap out‑of‑bounds read followed by heap corruption during ACL inheritance. This memory corruption can lead to kernel instability, a denial‑of‑service condition, or, in the worst case, privilege escalation to kernel code execution. The weakness is a classic out‑of‑bounds read (CWE‑125).

The affected product is the Linux ksmbd SMB server component. The CVE marks the vendor as Linux:ksmbd, but no specific kernel or ksmbd release versions are listed in the data. All systems running a version of ksmbd that includes the flawed ACL inheritance logic are potentially vulnerable, with no version or patch information provided in the available dataset.

The flaw scores a high CVSS value of 8.7, indicating a severe risk. No EPSS score was provided, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers can exploit the weakness remotely by authenticating to the SMB service with directory creation rights, performing an SMB2_SET_INFO operation to assign the rogue DACL, and then creating child objects to trigger the out‑of‑bounds read. Because the vulnerability operates at the kernel level, it offers a pathway for privilege escalation once the memory corruption succeeds. The lack of an immediate patch in the current data set heightens urgency, especially for exposed SMB services.