FKIE_CVE-2026-90153

Vulnerability from fkie_nvd - Published: 2026-09-17 17:17 - Updated: 2026-09-18 18:17
Severity
8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size smb_check_perm_dacl() validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length (acl_size) rather than the DACL's declared size (pdacl_size). When pdacl->size is smaller than the trailing NTSD buffer, bytes after the declared DACL boundary - still inside the stored security descriptor - are parsed as ACEs during access checks. A crafted DACL can place an access-granting ACE beyond pdacl->size, and the current code accepts it during SMB2_CREATE access validation, while parse_dacl() and smb_inherit_dacl() stop at pdacl_size. Bound both ACE walks by pdacl_size to match the DACL boundary semantics used elsewhere in the server. Validation: - semantic KUnit harness shows the post-boundary ACE is selected before the fix and rejected (EACCES) after it - linux master (7.2-rc6), x86_64
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/79decd88dd3f0d42e7fb0689b1a7853bfa302459
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8e4f75e979c1d9a51b0a48ac33d0cfd5f039ec67
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a2051ffe452afad52f580b85a3fd8851933b1e7c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a29f57a14c939586d84d7fd6a029bd1fd170098f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a4a307d149327dad5fb25187e1b03cebd1b04de6
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smbacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a2051ffe452afad52f580b85a3fd8851933b1e7c",
              "status": "affected",
              "version": "8f0541186e9ad1b62accc9519cc2b7a7240272a7",
              "versionType": "git"
            },
            {
              "lessThan": "a29f57a14c939586d84d7fd6a029bd1fd170098f",
              "status": "affected",
              "version": "8f0541186e9ad1b62accc9519cc2b7a7240272a7",
              "versionType": "git"
            },
            {
              "lessThan": "a4a307d149327dad5fb25187e1b03cebd1b04de6",
              "status": "affected",
              "version": "8f0541186e9ad1b62accc9519cc2b7a7240272a7",
              "versionType": "git"
            },
            {
              "lessThan": "8e4f75e979c1d9a51b0a48ac33d0cfd5f039ec67",
              "status": "affected",
              "version": "8f0541186e9ad1b62accc9519cc2b7a7240272a7",
              "versionType": "git"
            },
            {
              "lessThan": "79decd88dd3f0d42e7fb0689b1a7853bfa302459",
              "status": "affected",
              "version": "8f0541186e9ad1b62accc9519cc2b7a7240272a7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cb69d4d6f709f87c94afa28ae64c501576692171",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6e8f4abf584253cbaa596ea4ad13110cf61cd4c9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8e33102309bd6839b2e2e158f93a7b378cb4655d",
              "versionType": "git"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.62",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19",
              "status": "affected",
              "version": "5.18.18",
              "versionType": "semver"
            },
            {
              "lessThan": "5.20",
              "status": "affected",
              "version": "5.19.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smbacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: bound smb_check_perm_dacl() ACE walks by DACL size\n\nsmb_check_perm_dacl() validates that the DACL fits inside the NT\nsecurity descriptor, but then bounds its two ACE walks by the\nremaining NTSD length (acl_size) rather than the DACL\u0027s declared\nsize (pdacl_size).\n\nWhen pdacl-\u003esize is smaller than the trailing NTSD buffer, bytes\nafter the declared DACL boundary - still inside the stored security\ndescriptor - are parsed as ACEs during access checks.  A crafted\nDACL can place an access-granting ACE beyond pdacl-\u003esize, and the\ncurrent code accepts it during SMB2_CREATE access validation, while\nparse_dacl() and smb_inherit_dacl() stop at pdacl_size.\n\nBound both ACE walks by pdacl_size to match the DACL boundary\nsemantics used elsewhere in the server.\n\nValidation:\n- semantic KUnit harness shows the post-boundary ACE is selected\n  before the fix and rejected (EACCES) after it\n- linux master (7.2-rc6), x86_64"
    }
  ],
  "id": "CVE-2026-90153",
  "lastModified": "2026-09-18T18:17:44.427",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-17T17:17:08.370",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/79decd88dd3f0d42e7fb0689b1a7853bfa302459"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8e4f75e979c1d9a51b0a48ac33d0cfd5f039ec67"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a2051ffe452afad52f580b85a3fd8851933b1e7c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a29f57a14c939586d84d7fd6a029bd1fd170098f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a4a307d149327dad5fb25187e1b03cebd1b04de6"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.