25 matches found
SUSE CVE-2026-90153
In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smbcheckpermdacl ACE walks by DACL size smbcheckpermdacl validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length aclsize rather than the DACL's...
Linux Distros Unpatched Vulnerability : CVE-2026-90153
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: bound smbcheckpermdacl ACE walks by DACL size smbcheckpermdacl validates that the DACL fits inside the NT security descriptor, but then bounds its two AC...
DEBIAN-CVE-2026-90153
In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smbcheckpermdacl ACE walks by DACL size smbcheckpermdacl validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length aclsize rather than the DACL's...
AZL-102458 CVE-2026-90153 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smbcheckpermdacl ACE walks by DACL size smbcheckpermdacl validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length aclsize rather than the DACL's...
CVE-2026-90153
In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smbcheckpermdacl ACE walks by DACL size smbcheckpermdacl validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length aclsize rather than the DACL's...
CVE-2026-90153 ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size
In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smbcheckpermdacl ACE walks by DACL size smbcheckpermdacl validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length aclsize rather than the DACL's...
CVE-2026-90153
CVE-2026-90153 affects the Linux kernel ksmbd subsystem (in-kernel SMB server). The vulnerable function smb_check_perm_dacl() bounds its ACE walks by the remaining NT security descriptor length (acl_size) instead of the DACL's declared size (pdacl_size). An attacker with low privileges can craft ...
CVE-2026-90153 ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size
In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smbcheckpermdacl ACE walks by DACL size smbcheckpermdacl validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length aclsize rather than the DACL's...
EUVD-2026-81746
In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smbcheckpermdacl ACE walks by DACL size smbcheckpermdacl validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length aclsize rather than the DACL's...
CVE-2026-90153: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smbcheckpermdacl ACE walks by DACL size smbcheckpermdacl validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length aclsize rather than the DACL's...
CVE-2026-63909: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smbcheckpermdacl ACE-walk loops Commit d07b26f39246 "ksmbd: require minimum ACE size in smbcheckpermdacl" introduced a transposed bounds check: if offsetofstruct smbace, sid + acessize size offset 2...
CVE-2026-53390: Out-of-bounds Read
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds read in smbcheckpermdacl The permission-check ACE walk in smbcheckpermdacl validates the ACE header size and caps sid.numsubauth at SIDMAXSUBAUTHORITIES, but it never checks that ace-size is actually larg...
Linux kernel smb_check_perm_dacl function out-of-bounds read vulnerability
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. The Linux kernel suffers from an out-of-bounds read vulnerability. The vulnerability stems from insufficient ACE size validation in the smbcheckpermdacl function of ksmbd, whic...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: ksmbd: A regression in the OOB read operation in smbcheckpermdacl occurred during the ACE-walk loop. The commit d07b26f39246 “ksmbd: requires a minimum ACE size in smbcheckpermdacl” introduced a transposed bounds check: c if...
CVE-2026-31712 ksmbd: require minimum ACE size in smb_check_perm_dacl()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: require minimum ACE size in smbcheckpermdacl Both ACE-walk loops in smbcheckpermdacl only guard against an under-sized remaining buffer, not against an ACE whose declared ace-size is smaller than the struct it claims to...
CVE-2026-31712
In the Linux kernel, the following vulnerability has been resolved: ksmbd: require minimum ACE size in smbcheckpermdacl Both ACE-walk loops in smbcheckpermdacl only guard against an under-sized remaining buffer, not against an ACE whose declared ace-size is smaller than the struct it claims to...
CVE-2026-31712: Out-of-bounds Write
In the Linux kernel, the following vulnerability has been resolved: ksmbd: require minimum ACE size in smbcheckpermdacl Both ACE-walk loops in smbcheckpermdacl only guard against an under-sized remaining buffer, not against an ACE whose declared ace-size is smaller than the struct it claims to...
Linux Kernel Security Vulnerabilities
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. The Linux kernel suffers from an out-of-bounds read vulnerability. The vulnerability stems from insufficient ACE size validation in the smbcheckpermdacl function of ksmbd, whic...
SMB Server Access Privilege Escalation
The vulnerabilities of the functions smbinheritdacl and smbcheckpermdacl in the fs/smb/server/smbacl.c module are related to memory access beyond the allocated buffer. Exploiting these vulnerabilities can allow an attacker to gain access to protected information or cause service failures...