The ksmbd SMB server component of the Linux kernel contains a flaw where the parse_dacl() function silently accepts truncated Access Control Entries and allocation failures. Because those parsing and allocation errors are not propagated, the set_info_sec() call continues with an incomplete ACL conversion, allowing malformed security descriptors to be written into inode attributes or ACL extended attributes without detection. This improper input validation and error handling can result in incorrect permission assignments or unintended access rights, effectively permitting an attacker who can influence ACL data to grant themselves higher privileges on files or directories.

All Linux kernel installations that include the ksmbd component are affected. The vulnerability applies to the Linux kernel as a whole, so any distribution that incorporates the ksmbd code and has not applied a fix is susceptible. No specific version ranges are supplied; therefore, administrators should verify whether their kernel image contains ksmbd and whether the current version includes the applied fix.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog or known to have public exploits. Based on the description, it is inferred that the likely attack vector is a crafted SMB payload sent by an attacker with an active SMB session that can transmit malformed security descriptors; thus, exposure requires an SMB service exposed to potential threat actors. If successful, the attacker could alter ACLs to gain unauthorized access to files or directories.