High 8.1Published Jul 19, 2026

CVE-2026-63909ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops

Updated under an hour ago (Oct 28, 2026, 7:23 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Commit d07b26f39246 ("ksmbd: require minimum ACE size in smb_check_perm_dacl()") introduced a transposed bounds check: if (offsetof(struct smb_ace, sid) + aces_size < CIFS_SID_BASE_SIZE) Since offsetof(..sid) is 8 and CIFS_SID_BASE_SIZE is 8, this evaluates to `aces_size < 0`. Because `aces_size` is always non-negative, this check becomes dead code and never breaks the loop. Worse, that commit removed the old 4-byte guard, meaning the loop now reads `ace->size` (offset 2) even when `aces_size` is 0-3 bytes. This re-opens a 2-byte heap out-of-bounds (OOB) read past the pntsd allocation during subsequent SMB2_CREATE operations. Fix this by properly transposing the comparison to require at least 16 bytes (8-byte offset + 8-byte SID base), matching the correct form used in smb_inherit_dacl().

CVSS: 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Awaiting Analysis
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 282cbbb476b9f35793452bc461934af4c7eca169 before 5500ba1d410aed1eded3eb04a76b10cfb4409334; from f20adc4ef7428bc485ee83fd1a592252fb87718b before f6324b4240cf0b26a84c33f68a1222d727ff4af2; 325d4ac11f526cb8964cff14548ccf02d8c756d8 builds before 0fe08c5776a798f46df1fd74b331be26bdd644d6; from 95e5aa3c3261da8c95b27d7aecf8ee39b9f86a4c before d333af32e4451285e427f2d9c29de3a39f6f6d48; 90089584b2e25c4510b7b987387b4405f0673ece builds before 94215d55b09445993929f4fc966061d61de74929; 151b1799861fde38087c08f613abc2843ef597b0 builds before 4f7c131d2bdd7cd64b96f60d10be5ea72253f520; from d07b26f39246a82399661936dd0c853983cfade7 before 0e60dafe97eca61721f3db456f97d97a80c6c8ae	CNA record

References

References

https://git.kernel.org/stable/c/5500ba1d410aed1eded3eb04a76b10cfb4409334
https://git.kernel.org/stable/c/f6324b4240cf0b26a84c33f68a1222d727ff4af2
https://git.kernel.org/stable/c/0fe08c5776a798f46df1fd74b331be26bdd644d6
https://git.kernel.org/stable/c/d333af32e4451285e427f2d9c29de3a39f6f6d48
https://git.kernel.org/stable/c/94215d55b09445993929f4fc966061d61de74929
https://git.kernel.org/stable/c/4f7c131d2bdd7cd64b96f60d10be5ea72253f520
https://git.kernel.org/stable/c/0e60dafe97eca61721f3db456f97d97a80c6c8ae

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.