CVE-2026-90153

A flaw was found in ksmbd, the in-kernel SMB3 server for Linux. The smb_check_perm_dacl() function incorrectly validates Access Control Entry (ACE) walks by using the remaining security descriptor length instead of the declared Discretionary Access Control List (DACL) size. This allows a remote attacker to craft a malicious DACL that places an access-granting ACE beyond the intended boundary. Consequently, this bypasses access checks during SMB2_CREATE operations, potentially leading to unauthorized access to resources.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.