{"api_version":"1","generated_at":"2026-07-24T18:52:42+00:00","cve":"CVE-2026-53390","urls":{"html":"https://cve.report/CVE-2026-53390","api":"https://cve.report/api/cve/CVE-2026-53390.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-53390","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-53390"},"summary":{"title":"ksmbd: fix out-of-bounds read in smb_check_perm_dacl()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix out-of-bounds read in smb_check_perm_dacl()\n\nThe permission-check ACE walk in smb_check_perm_dacl() validates the ACE\nheader size and caps sid.num_subauth at SID_MAX_SUB_AUTHORITIES, but it\nnever checks that ace->size is actually large enough to contain\nnum_subauth sub-authorities before compare_sids() dereferences them.\n\nCIFS_SID_BASE_SIZE covers the SID header up to but excluding the\nsub_auth[] array, and offsetof(struct smb_ace, sid) is the ACE header,\nso the existing guards only guarantee the 8-byte SID base, i.e. zero\nsub-authorities. compare_sids() then reads ace->sid.sub_auth[i] for\ni < min(local_sid->num_subauth, ace->sid.num_subauth). The local\ncomparison SIDs (sid_everyone, sid_unix_NFS_mode, and the id_to_sid()\nresult) always have at least one sub-authority, and an attacker controls\nthe ACE revision and authority bytes (which lie within the in-bounds SID\nbase), so they can match one of those SIDs and force the sub_auth read.\n\nA crafted ACE with size == 16 and num_subauth >= 1 placed at the tail of\nthe security descriptor therefore causes a heap out-of-bounds read of up\nto SID_MAX_SUB_AUTHORITIES * sizeof(__le32) bytes past the pntsd\nallocation. The security descriptor is loaded by ksmbd_vfs_get_sd_xattr()\ninto a buffer sized exactly to the on-disk data (kzalloc(sd_size) in\nndr_decode_v4_ntacl()), so the read lands past the allocation. The\nmalformed descriptor can be stored verbatim via SMB2_SET_INFO (the DACL\nis not normalised before being written to the security.NTACL xattr) and\nthe read fires on a subsequent SMB2_CREATE access check, making this\nreachable by an authenticated client on a share that uses ACL xattrs.\n\nAdd the missing num_subauth-versus-ace_size check, mirroring the\nidentical guards already present in the sibling parsers parse_dacl() and\nsmb_inherit_dacl().","state":"PUBLISHED","assigner":"Linux","published_at":"2026-07-19 12:16:50","updated_at":"2026-07-24 15:18:00"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","data":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/d5c81a095c86fe507c032d08f3a8cfc518444927","name":"https://git.kernel.org/stable/c/d5c81a095c86fe507c032d08f3a8cfc518444927","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e36e35660adb9b8ef1435ac359151dda5f094c55","name":"https://git.kernel.org/stable/c/e36e35660adb9b8ef1435ac359151dda5f094c55","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/988c93d3bba066d8669143e6ec30bb2be9608d53","name":"https://git.kernel.org/stable/c/988c93d3bba066d8669143e6ec30bb2be9608d53","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/36599894fa8536fefdf1e296c0af71b8b7226859","name":"https://git.kernel.org/stable/c/36599894fa8536fefdf1e296c0af71b8b7226859","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c7488c85fd822959e9b5c22fbd9e7c8a21caf5e0","name":"https://git.kernel.org/stable/c/c7488c85fd822959e9b5c22fbd9e7c8a21caf5e0","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7627ff8c4f9919f14de562b0160ab4ec9d80b1f7","name":"https://git.kernel.org/stable/c/7627ff8c4f9919f14de562b0160ab4ec9d80b1f7","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/1ef06004ed4bd6d3ed8c840d9d1a376b66d4935b","name":"https://git.kernel.org/stable/c/1ef06004ed4bd6d3ed8c840d9d1a376b66d4935b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53390","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53390","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 282cbbb476b9f35793452bc461934af4c7eca169 c7488c85fd822959e9b5c22fbd9e7c8a21caf5e0 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f20adc4ef7428bc485ee83fd1a592252fb87718b 988c93d3bba066d8669143e6ec30bb2be9608d53 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 325d4ac11f526cb8964cff14548ccf02d8c756d8 36599894fa8536fefdf1e296c0af71b8b7226859 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 95e5aa3c3261da8c95b27d7aecf8ee39b9f86a4c d5c81a095c86fe507c032d08f3a8cfc518444927 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 90089584b2e25c4510b7b987387b4405f0673ece 7627ff8c4f9919f14de562b0160ab4ec9d80b1f7 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d07b26f39246a82399661936dd0c853983cfade7 e36e35660adb9b8ef1435ac359151dda5f094c55 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d07b26f39246a82399661936dd0c853983cfade7 1ef06004ed4bd6d3ed8c840d9d1a376b66d4935b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 151b1799861fde38087c08f613abc2843ef597b0 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.15.210 5.15.212 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.1.176 6.1.177 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.6.140 6.6.144 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.12.84 6.12.95 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.18.25 6.18.38 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7.0.2 7.1 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7.1","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.212 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.177 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.144 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.95 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.38 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.3 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"53390","cve":"CVE-2026-53390","epss":"0.001720000","percentile":"0.069020000","score_date":"2026-07-20","updated_at":"2026-07-21 00:13:14"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c7488c85fd822959e9b5c22fbd9e7c8a21caf5e0","status":"affected","version":"282cbbb476b9f35793452bc461934af4c7eca169","versionType":"git"},{"lessThan":"988c93d3bba066d8669143e6ec30bb2be9608d53","status":"affected","version":"f20adc4ef7428bc485ee83fd1a592252fb87718b","versionType":"git"},{"lessThan":"36599894fa8536fefdf1e296c0af71b8b7226859","status":"affected","version":"325d4ac11f526cb8964cff14548ccf02d8c756d8","versionType":"git"},{"lessThan":"d5c81a095c86fe507c032d08f3a8cfc518444927","status":"affected","version":"95e5aa3c3261da8c95b27d7aecf8ee39b9f86a4c","versionType":"git"},{"lessThan":"7627ff8c4f9919f14de562b0160ab4ec9d80b1f7","status":"affected","version":"90089584b2e25c4510b7b987387b4405f0673ece","versionType":"git"},{"lessThan":"e36e35660adb9b8ef1435ac359151dda5f094c55","status":"affected","version":"d07b26f39246a82399661936dd0c853983cfade7","versionType":"git"},{"lessThan":"1ef06004ed4bd6d3ed8c840d9d1a376b66d4935b","status":"affected","version":"d07b26f39246a82399661936dd0c853983cfade7","versionType":"git"},{"status":"affected","version":"151b1799861fde38087c08f613abc2843ef597b0","versionType":"git"},{"lessThan":"5.15.212","status":"affected","version":"5.15.210","versionType":"semver"},{"lessThan":"6.1.177","status":"affected","version":"6.1.176","versionType":"semver"},{"lessThan":"6.6.144","status":"affected","version":"6.6.140","versionType":"semver"},{"lessThan":"6.12.95","status":"affected","version":"6.12.84","versionType":"semver"},{"lessThan":"6.18.38","status":"affected","version":"6.18.25","versionType":"semver"},{"lessThan":"7.1","status":"affected","version":"7.0.2","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.1"},{"lessThan":"7.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.177","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.144","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.95","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.38","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.212","versionStartIncluding":"5.15.210","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.177","versionStartIncluding":"6.1.176","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.144","versionStartIncluding":"6.6.140","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.95","versionStartIncluding":"6.12.84","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.38","versionStartIncluding":"6.18.25","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.3","versionStartIncluding":"7.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2-rc1","versionStartIncluding":"7.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix out-of-bounds read in smb_check_perm_dacl()\n\nThe permission-check ACE walk in smb_check_perm_dacl() validates the ACE\nheader size and caps sid.num_subauth at SID_MAX_SUB_AUTHORITIES, but it\nnever checks that ace->size is actually large enough to contain\nnum_subauth sub-authorities before compare_sids() dereferences them.\n\nCIFS_SID_BASE_SIZE covers the SID header up to but excluding the\nsub_auth[] array, and offsetof(struct smb_ace, sid) is the ACE header,\nso the existing guards only guarantee the 8-byte SID base, i.e. zero\nsub-authorities. compare_sids() then reads ace->sid.sub_auth[i] for\ni < min(local_sid->num_subauth, ace->sid.num_subauth). The local\ncomparison SIDs (sid_everyone, sid_unix_NFS_mode, and the id_to_sid()\nresult) always have at least one sub-authority, and an attacker controls\nthe ACE revision and authority bytes (which lie within the in-bounds SID\nbase), so they can match one of those SIDs and force the sub_auth read.\n\nA crafted ACE with size == 16 and num_subauth >= 1 placed at the tail of\nthe security descriptor therefore causes a heap out-of-bounds read of up\nto SID_MAX_SUB_AUTHORITIES * sizeof(__le32) bytes past the pntsd\nallocation. The security descriptor is loaded by ksmbd_vfs_get_sd_xattr()\ninto a buffer sized exactly to the on-disk data (kzalloc(sd_size) in\nndr_decode_v4_ntacl()), so the read lands past the allocation. The\nmalformed descriptor can be stored verbatim via SMB2_SET_INFO (the DACL\nis not normalised before being written to the security.NTACL xattr) and\nthe read fires on a subsequent SMB2_CREATE access check, making this\nreachable by an authenticated client on a share that uses ACL xattrs.\n\nAdd the missing num_subauth-versus-ace_size check, mirroring the\nidentical guards already present in the sibling parsers parse_dacl() and\nsmb_inherit_dacl()."}],"metrics":[{"cvssV3_1":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"}}],"providerMetadata":{"dateUpdated":"2026-07-24T14:33:56.623Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/c7488c85fd822959e9b5c22fbd9e7c8a21caf5e0"},{"url":"https://git.kernel.org/stable/c/988c93d3bba066d8669143e6ec30bb2be9608d53"},{"url":"https://git.kernel.org/stable/c/36599894fa8536fefdf1e296c0af71b8b7226859"},{"url":"https://git.kernel.org/stable/c/d5c81a095c86fe507c032d08f3a8cfc518444927"},{"url":"https://git.kernel.org/stable/c/7627ff8c4f9919f14de562b0160ab4ec9d80b1f7"},{"url":"https://git.kernel.org/stable/c/e36e35660adb9b8ef1435ac359151dda5f094c55"},{"url":"https://git.kernel.org/stable/c/1ef06004ed4bd6d3ed8c840d9d1a376b66d4935b"}],"title":"ksmbd: fix out-of-bounds read in smb_check_perm_dacl()","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-53390","datePublished":"2026-07-19T12:01:54.951Z","dateReserved":"2026-06-09T07:44:35.402Z","dateUpdated":"2026-07-24T14:33:56.623Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-07-19 12:16:50","lastModifiedDate":"2026-07-24 15:18:00","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"53390","Ordinal":"1","Title":"ksmbd: fix out-of-bounds read in smb_check_perm_dacl()","CVE":"CVE-2026-53390","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"53390","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix out-of-bounds read in smb_check_perm_dacl()\n\nThe permission-check ACE walk in smb_check_perm_dacl() validates the ACE\nheader size and caps sid.num_subauth at SID_MAX_SUB_AUTHORITIES, but it\nnever checks that ace->size is actually large enough to contain\nnum_subauth sub-authorities before compare_sids() dereferences them.\n\nCIFS_SID_BASE_SIZE covers the SID header up to but excluding the\nsub_auth[] array, and offsetof(struct smb_ace, sid) is the ACE header,\nso the existing guards only guarantee the 8-byte SID base, i.e. zero\nsub-authorities. compare_sids() then reads ace->sid.sub_auth[i] for\ni < min(local_sid->num_subauth, ace->sid.num_subauth). The local\ncomparison SIDs (sid_everyone, sid_unix_NFS_mode, and the id_to_sid()\nresult) always have at least one sub-authority, and an attacker controls\nthe ACE revision and authority bytes (which lie within the in-bounds SID\nbase), so they can match one of those SIDs and force the sub_auth read.\n\nA crafted ACE with size == 16 and num_subauth >= 1 placed at the tail of\nthe security descriptor therefore causes a heap out-of-bounds read of up\nto SID_MAX_SUB_AUTHORITIES * sizeof(__le32) bytes past the pntsd\nallocation. The security descriptor is loaded by ksmbd_vfs_get_sd_xattr()\ninto a buffer sized exactly to the on-disk data (kzalloc(sd_size) in\nndr_decode_v4_ntacl()), so the read lands past the allocation. The\nmalformed descriptor can be stored verbatim via SMB2_SET_INFO (the DACL\nis not normalised before being written to the security.NTACL xattr) and\nthe read fires on a subsequent SMB2_CREATE access check, making this\nreachable by an authenticated client on a share that uses ACL xattrs.\n\nAdd the missing num_subauth-versus-ace_size check, mirroring the\nidentical guards already present in the sibling parsers parse_dacl() and\nsmb_inherit_dacl().","Type":"Description","Title":"ksmbd: fix out-of-bounds read in smb_check_perm_dacl()"}]}}}