CVE-2026-53390

A flaw was found in the Linux kernel's ksmbd component. An authenticated client can exploit an out-of-bounds read vulnerability in the smb_check_perm_dacl() function by providing a specially crafted Access Control Entry (ACE). This crafted ACE, when processed during an access check on a share that uses ACL extended attributes, can lead to a heap out-of-bounds read. The primary consequence of this vulnerability is information disclosure, where sensitive data beyond the intended memory boundary may be exposed.

An information disclosure flaw of low impact was found in the Linux kernel's ksmbd kernel SMB server. The smb_check_perm_dacl() function caps the number of SID sub-authorities but never verifies that an Access Control Entry (ACE) is actually large enough to contain the sub-authorities it declares before compare_sids() dereferences them. On a share that uses ACL extended attributes, an authenticated SMB client can store a crafted security descriptor via SMB2_SET_INFO whose DACL ends with such an ACE, so that a subsequent SMB2_CREATE access check triggers a heap out-of-bounds read of up to SID_MAX_SUB_AUTHORITIES * sizeof(__le32) bytes past the security-descriptor allocation. This can expose sensitive kernel memory (information disclosure) and may crash the kernel. Red Hat Enterprise Linux and Red Hat In-Vehicle OS are not affected by this flaw because the vulnerable ksmbd code is not present in the shipped Red Hat kernels. Although the upstream CVE record rates this flaw as IMPORTANT (CVSS 3.1 score 8.1), Red Hat's rating is lower (CVSS 3.1 score 5.9, moderate severity; low impact), reflecting the higher attack complexity and lower assessed confidentiality impact of an out-of-bounds read reachable only by an authenticated client.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.