CVE-2026-63909

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops

Commit d07b26f39246 ("ksmbd: require minimum ACE size in

smb_check_perm_dacl()") introduced a transposed bounds check:

if (offsetof(struct smb_ace, sid) + aces_size < CIFS_SID_BASE_SIZE)

Since offsetof(..sid) is 8 and CIFS_SID_BASE_SIZE is 8, this evaluates

to `aces_size < 0`. Because `aces_size` is always non-negative, this

check becomes dead code and never breaks the loop.

Worse, that commit removed the old 4-byte guard, meaning the loop now

reads `ace->size` (offset 2) even when `aces_size` is 0-3 bytes. This

re-opens a 2-byte heap out-of-bounds (OOB) read past the pntsd allocation

during subsequent SMB2_CREATE operations.

Fix this by properly transposing the comparison to require at least

16 bytes (8-byte offset + 8-byte SID base), matching the correct form

used in smb_inherit_dacl().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References