The vulnerability originates from the Linux kernel’s ksmbd component. The parse_dacl() function silently accepts truncated ACEs and allocation failures, allowing the subsequent set_info_sec() operation to proceed with an incomplete ACL conversion. This failure to reject malformed security descriptors means that ACL updates are applied incorrectly, potentially allowing malicious actors to manipulate file permissions or inherit undesired access rights. The flaw is a result of improper input validation and error handling (CWE-20).

All Linux kernel installations that include the ksmbd SMB server component are affected. The issue applies to the broader Linux:Linux kernel thus affecting any distribution that incorporates the kernel version affected, without specific version bounds provided. Administrators should verify whether their kernel includes ksmbd and assess the presence of this defect.

The CVE does not list a CVSS score or EPSS score, and it is not present in the CISA KEV catalog, indicating that no known public exploitation reports are available at this time. Nonetheless, because the flaw can lead to incorrect permission settings, the risk to confidentiality and integrity may be high if an attacker can influence ACL structures. The vulnerability would be exploitable only on systems running the SMB service and targeting vulnerable inode ACL handling; no net remote code execution is documented. Administrators should monitor for vendor patches.