CVE-2026-90153 - Vulnerability Details

- ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size

smb_check_perm_dacl() validates that the DACL fits inside the NT
security descriptor, but then bounds its two ACE walks by the
remaining NTSD length (acl_size) rather than the DACL's declared
size (pdacl_size).

When pdacl->size is smaller than the trailing NTSD buffer, bytes
after the declared DACL boundary - still inside the stored security
descriptor - are parsed as ACEs during access checks. A crafted
DACL can place an access-granting ACE beyond pdacl->size, and the
current code accepts it during SMB2_CREATE access validation, while
parse_dacl() and smb_inherit_dacl() stop at pdacl_size.

Bound both ACE walks by pdacl_size to match the DACL boundary
semantics used elsewhere in the server.

Validation:
- semantic KUnit harness shows the post-boundary ACE is selected
before the fix and rejected (EACCES) after it
- linux master (7.2-rc6), x86_64

Published: 2026-09-17

Score: 8.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s SMB server accidentally parses security descriptor data after the declared DACL boundary. A crafted DACL can insert an ACE that grants access beyond the proper size, and the SMB2_CREATE access validation accepts this ACE while other parsing functions do not. This flaw allows an attacker to gain unauthorized SMB access and potentially elevate privileges on the host. The weakness is a failure of proper bounds checking and input validation, leading to an authorization bypass.

Affected Systems

The vulnerability affects Linux systems running the default kernel implementation. The patch is available in the Linux kernel master branch from commit 7.2-rc6 onward on x86_64 architectures. Linux versions that did not incorporate this commit remain vulnerable.

Risk and Exploitability

The CVSS score of 8.1 indicates high severity, and the EPSS score of less than 1% shows a low current exploitation probability. The report is not listed in CISA’s KEV catalog. Attackers can exploit this flaw remotely by sending a specially crafted SMB2 request to an exposed SMB server. The vulnerability is specific to SMB server access checks performed by the kernel’s ksmbd component and requires network connectivity to the target.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8f0541186e9ad1b62accc9519cc2b7a7240272a7`	affected	< a2051ffe452afad52f580b85a3fd8851933b1e7c
`8f0541186e9ad1b62accc9519cc2b7a7240272a7`	affected	< a29f57a14c939586d84d7fd6a029bd1fd170098f
`8f0541186e9ad1b62accc9519cc2b7a7240272a7`	affected	< a4a307d149327dad5fb25187e1b03cebd1b04de6
`8f0541186e9ad1b62accc9519cc2b7a7240272a7`	affected	< 8e4f75e979c1d9a51b0a48ac33d0cfd5f039ec67
`8f0541186e9ad1b62accc9519cc2b7a7240272a7`	affected	< 79decd88dd3f0d42e7fb0689b1a7853bfa302459
`cb69d4d6f709f87c94afa28ae64c501576692171`	affected	—
`6e8f4abf584253cbaa596ea4ad13110cf61cd4c9`	affected	—
`8e33102309bd6839b2e2e158f93a7b378cb4655d`	affected	—
`5.15.62`	affected	< 5.16
`5.18.18`	affected	< 5.19
`5.19.2`	affected	< 5.20

Linux

affected

Version	Status	Constraints
`6.0`	affected	—
`0`	unaffected	< 6.0
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[8f0541186e9ad1b62accc9519cc2b7a7240272a7,a2051ffe452afad52f580b85a3fd8851933b1e7c)`	affected	code_commit	—
`[8f0541186e9ad1b62accc9519cc2b7a7240272a7,a29f57a14c939586d84d7fd6a029bd1fd170098f)`	affected	code_commit	—
`[8f0541186e9ad1b62accc9519cc2b7a7240272a7,a4a307d149327dad5fb25187e1b03cebd1b04de)`	affected	code_commit	—
`[8f0541186e9ad1b62accc9519cc2b7a7240272a7,8e4f75e979c1d9a51b0a48ac33d0cfd5f039ec67)`	affected	code_commit	—
`[8f0541186e9ad1b62accc9519cc2b7a7240272a7,79decd88dd3f0d42e7fb0689b1a7853bfa302459)`	affected	code_commit	—
`cb69d4d6f709f87c94afa28ae64c501576692171`	affected	code_commit	—
`6e8f4abf584253cbaa596ea4ad13110cf61cd4c9`	affected	code_commit	—
`8e33102309bd6839b2e158f93a7b378cb4655d`	affected	code_commit	—
`[5.15.62,5.16)`	affected	semver	—
`[5.18.18,5.19)`	affected	semver	—
`[5.19.2,5.20)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.0`	affected	semver	—
`[0,6.0)`	unaffected	generic	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a release that includes the patch from commit 7.2-rc6 or later.
Configure firewall rules or network segmentation to restrict or block SMB traffic to the vulnerable host.
Audit all SMB servers for unnecessary service exposure and disable SMB services that are not required.

Generated by OpenCVE AI on September 20, 2026 at 01:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00478.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/79decd88dd3f0d42e7fb0689b1a7853bfa302459
https://git.kernel.org/stable/c/8e4f75e979c1d9a51b0a48ac33d0cfd5f039ec67
https://git.kernel.org/stable/c/a2051ffe452afad52f580b85a3fd8851933b1e7c
https://git.kernel.org/stable/c/a29f57a14c939586d84d7fd6a029bd1fd170098f
https://git.kernel.org/stable/c/a4a307d149327dad5fb25187e1b03cebd1b04de6

History

Sun, 20 Sep 2026 02:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-122 CWE-125

Fri, 18 Sep 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}`

Thu, 17 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size smb_check_perm_dacl() validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length (acl_size) rather than the DACL's declared size (pdacl_size). When pdacl->size is smaller than the trailing NTSD buffer, bytes after the declared DACL boundary - still inside the stored security descriptor - are parsed as ACEs during access checks. A crafted DACL can place an access-granting ACE beyond pdacl->size, and the current code accepts it during SMB2_CREATE access validation, while parse_dacl() and smb_inherit_dacl() stop at pdacl_size. Bound both ACE walks by pdacl_size to match the DACL boundary semantics used elsewhere in the server. Validation: - semantic KUnit harness shows the post-boundary ACE is selected before the fix and rejected (EACCES) after it - linux master (7.2-rc6), x86_64
Title		ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/79decd88dd3f0d42e7fb0689b1a7853bfa302459 https://git.kernel.org/stable/c/8e4f75e979c1d9a51b0a48ac33d0cfd5f039ec67 https://git.kernel.org/stable/c/a2051ffe452afad52f580b85a3fd8851933b1e7c https://git.kernel.org/stable/c/a29f57a14c939586d84d7fd6a029bd1fd170098f https://git.kernel.org/stable/c/a4a307d149327dad5fb25187e1b03cebd1b04de6

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:06:46.296Z

Updated: 2026-09-18T17:53:28.059Z

Reserved: 2026-09-11T19:38:34.789Z

Link: CVE-2026-90153

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-17T17:17:08.370

Modified: 2026-09-18T18:17:44.427

Link: CVE-2026-90153

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-20T02:00:13Z

Weaknesses

CWE-122
Heap-based Buffer Overflow
CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object