In the Linux kernel, an ACL size validation bug in the SMB client lets an attacker send a crafted Access Control List to the cifs_do_set_acl() routine. The routine first checks the ACL size using posix_acl_xattr_size(), which expects 4 bytes for a header and 8 bytes per ACE. It then converts the ACL to the CIFS on‑wire format via posix_acl_to_cifs(), which requires 6 bytes for a header and 10 bytes per ACE. Because the converted size is larger than the original buffer, the write can overrun the heap. If an attacker supplies enough ACE entries, the overflow can corrupt adjacent memory, enabling arbitrary code execution or a denial of service. The vulnerability is a classic heap buffer overflow (CWE‑122).

The flaw exists in any Linux kernel that includes the CIFS/Samba client stack prior to the fix applied in the commits referenced. No specific kernel release is enumerated, so all kernels shipped with the unpatched CIFS client are potentially affected.

The vulnerability carries a high potential impact, as heap corruption can lead to privilege escalation or system compromise. The CVSS score is not listed, and the EPSS score is unavailable, but the missing inclusion in CISA’s KEV catalog suggests it has not yet been widely exploited. Attackers could exploit the flaw by sending a specially crafted ACL over an SMB connection to the vulnerable client. Because the buffer explosion occurs in userland code called from the kernel, an exploit could obtain root or elevated privileges on the target machine. Organizations should treat this issue as a high‑risk threat until a patched kernel is deployed.