CVE-2026-90153ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size
- 8.1HighCVSS base score
- 0.52%Exploitation in 30 daysEPSS · top 55% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size smb_check_perm_dacl() validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length (acl_size) rather than the DACL's declared size (pdacl_size). When pdacl->size is smaller than the trailing NTSD buffer, bytes after the declared DACL boundary - still inside the stored security descriptor - are parsed as ACEs during access checks. A crafted DACL can place an access-granting ACE beyond pdacl->size, and the current code accepts it during SMB2_CREATE access validation, while parse_dacl() and smb_inherit_dacl() stop at pdacl_size. Bound both ACE walks by pdacl_size to match the DACL boundary semantics used elsewhere in the server. Validation: - semantic KUnit harness shows the post-boundary ACE is selected before the fix and rejected (EACCES) after it - linux master (7.2-rc6), x86_64
Timeline
ID reserved
By Linux
- 6 days later
· 6 days later
Published
- 43 days later
· 43 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| NVDNVD · Received | 3.1 | High8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
- EPSS (exploitation in 30 days)
- 0.52% · top 55% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.
Affected products
- affected 8f0541186e9ad1b62accc9519cc2b7a7240272a7 – < 930dcdd888eabf166589e020dcbf6d15b5e13305
- affected 8f0541186e9ad1b62accc9519cc2b7a7240272a7 – < a2051ffe452afad52f580b85a3fd8851933b1e7c
- affected 8f0541186e9ad1b62accc9519cc2b7a7240272a7 – < a29f57a14c939586d84d7fd6a029bd1fd170098f
- affected 8f0541186e9ad1b62accc9519cc2b7a7240272a7 – < a4a307d149327dad5fb25187e1b03cebd1b04de6
- affected 8f0541186e9ad1b62accc9519cc2b7a7240272a7 – < 8e4f75e979c1d9a51b0a48ac33d0cfd5f039ec67
- affected 8f0541186e9ad1b62accc9519cc2b7a7240272a7 – < 79decd88dd3f0d42e7fb0689b1a7853bfa302459
- affected cb69d4d6f709f87c94afa28ae64c501576692171
- affected 6e8f4abf584253cbaa596ea4ad13110cf61cd4c9
- affected 8e33102309bd6839b2e2e158f93a7b378cb4655d
- affected 5.15.62 – < 5.16
- affected 5.18.18 – < 5.19
- affected 5.19.2 – < 5.20
- affected 6.0
- unaffected < 6.0
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.157 – ≤ 6.6.*
- unaffected 6.12.110 – ≤ 6.12.*
- unaffected 6.18.52 – ≤ 6.18.*
- unaffected 7.2.6 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References6
- https://git.kernel.org/stable/c/930dcdd888eabf166589e020dcbf6d15b5e13305 (opens in a new tab)
- https://git.kernel.org/stable/c/a2051ffe452afad52f580b85a3fd8851933b1e7c (opens in a new tab)
- https://git.kernel.org/stable/c/a29f57a14c939586d84d7fd6a029bd1fd170098f (opens in a new tab)
- https://git.kernel.org/stable/c/a4a307d149327dad5fb25187e1b03cebd1b04de6 (opens in a new tab)
- https://git.kernel.org/stable/c/8e4f75e979c1d9a51b0a48ac33d0cfd5f039ec67 (opens in a new tab)
- https://git.kernel.org/stable/c/79decd88dd3f0d42e7fb0689b1a7853bfa302459 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-81746 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-90153)Record last updated .