High · 8.1 CVE-2026-63909 EUVD-2026-45682GHSA-77x3-ghg7-w5wj

ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops

Published Jul 19, 2026 · Updated Aug 5, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.14 Package: linux-aws-6.17 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-6.8 Package: linux-aws-fips Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.14 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-6.8 Package: linux-azure-7.0 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.14 Package: linux-azure-fde-6.17 Package: linux-azure-fde-6.2 Package: linux-azure-fde-6.8 Package: linux-azure-fde-7.0 Package: linux-azure-fips Package: linux-azure-nvidia Package: linux-azure-nvidia-6.14 Package: linux-bluefield Package: linux-fips Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.14 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-6.8 Package: linux-gcp-7.0 Package: linux-gcp-fips Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.14 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-6.8 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-6.8 Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-lowlatency Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-lowlatency-hwe-6.8 Package: linux-nvidia Package: linux-nvidia-6.11 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-6.8 Package: linux-nvidia-7.0 Package: linux-nvidia-bos Package: linux-nvidia-lowlatency Package: linux-nvidia-tegra Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.14 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oem-7.0 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.14 Package: linux-oracle-6.5 Package: linux-oracle-6.8 Package: linux-oracle-7.0 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-realtime-6.14 Package: linux-realtime-6.8 Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.14 Package: linux-riscv-6.17 Package: linux-riscv-6.5 Package: linux-riscv-6.8 Package: linux-riscv-7.0 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Package: linux-xilinx Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops

Commit d07b26f39246 ("ksmbd: require minimum ACE size in
smb_check_perm_dacl()") introduced a transposed bounds check:

if (offsetof(struct smb_ace, sid) + aces_size < CIFS_SID_BASE_SIZE)

Since offsetof(..sid) is 8 and CIFS_SID_BASE_SIZE is 8, this evaluates
to `aces_size < 0`. Because `aces_size` is always non-negative, this
check becomes dead code and never breaks the loop.

Worse, that commit removed the old 4-byte guard, meaning the loop now
reads `ace->size` (offset 2) even when `aces_size` is 0-3 bytes. This
re-opens a 2-byte heap out-of-bounds (OOB) read past the pntsd allocation
during subsequent SMB2_CREATE operations.

Fix this by properly transposing the comparison to require at least
16 bytes (8-byte offset + 8-byte SID base), matching the correct form
used in smb_inherit_dacl().

Affected products

Vendor	Product	Affected	Fixed
Linux	Linux	6.6.140 – < 6.6.143, 6.12.84 – < 6.12.93, 6.18.25 – < 6.18.35, 7.0.2 – < 7.0.12	6.6.143

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	linux	7.0.12-1	—
Debian 13	linux	6.12.94-1	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu Nvidia-BlueField 24.04 LTS	linux-bluefield	6.8.0-1032.37	—
Ubuntu 26.04 LTS	linux	7.0.0-28.28	—
Ubuntu 26.04 LTS	linux-aws +1	7.0.0-1009.9	USN-8618-1
Ubuntu 26.04 LTS	linux-gcp +1	7.0.0-1008.8	USN-8593-1
Ubuntu 26.04 LTS	linux-gke	7.0.0-1003.4	—
Ubuntu 26.04 LTS	linux-ibm	7.0.0-1010.10	USN-8593-1
Ubuntu 26.04 LTS	linux-nvidia	7.0.0-1016.16	USN-8663-1
Ubuntu 26.04 LTS	linux-nvidia-bos	7.0.0-2016.16	USN-8664-1
Ubuntu 26.04 LTS	linux-raspi	7.0.0-1015.15	USN-8618-1
Ubuntu 26.04 LTS	linux-riscv +1	7.0.0-28.28.1	—
Ubuntu 24.04 LTS	linux	6.8.0-146.146	USN-8903-1
Ubuntu 24.04 LTS	linux-aws	6.8.0-1066.69	USN-8903-1
Ubuntu 24.04 LTS	linux-azure-7.0	7.0.0-1014.14~24.04.1	USN-8728-2
Ubuntu 24.04 LTS	linux-azure-fde	6.8.0-1068.75	USN-8904-1
Ubuntu 24.04 LTS	linux-azure-fde-7.0	7.0.0-1013.13~24.04.1	—
Ubuntu 24.04 LTS	linux-gcp +1	6.8.0-1070.78	USN-8905-2, USN-8904-1
Ubuntu 24.04 LTS	linux-gcp-7.0 +1	7.0.0-1011.11~24.04.1	USN-8728-3, USN-8728-1
Ubuntu 24.04 LTS	linux-gke	6.8.0-1065.73	USN-8903-2
Ubuntu 24.04 LTS	linux-gkeop	6.8.0-1051.55	USN-8903-2
Ubuntu 24.04 LTS	linux-ibm	6.8.0-1066.67	USN-8903-2
Ubuntu 24.04 LTS	linux-lowlatency	6.8.0-146.146.1	USN-8903-2
Ubuntu 24.04 LTS	linux-nvidia	6.8.0-1064.67	USN-8903-2
Ubuntu 24.04 LTS	linux-nvidia-7.0	7.0.0-1016.16~24.04.1	USN-8663-1
Ubuntu 24.04 LTS	linux-nvidia-lowlatency	6.8.0-1064.67.1	USN-8903-2
Ubuntu 24.04 LTS	linux-nvidia-tegra	6.8.0-1036.39	USN-8886-1
Ubuntu 24.04 LTS	linux-oracle	6.8.0-1063.66	USN-8903-2
Ubuntu 24.04 LTS	linux-raspi	6.8.0-1068.72	USN-9025-1
Ubuntu 24.04 LTS	linux-riscv +23	No fix yet	—
Ubuntu 24.04 LTS	linux-riscv-7.0	7.0.0-28.28.1~24.04.3	—
Ubuntu 22.04 LTS	linux-aws-6.8	6.8.0-1066.69~22.04.1	USN-8903-1
Ubuntu 22.04 LTS	linux-azure-fde-6.8	6.8.0-1068.75~22.04.1	USN-8904-1
Ubuntu 22.04 LTS	linux-gcp-6.8 +1	6.8.0-1070.78~22.04.1	USN-8905-1, USN-8904-1
Ubuntu 22.04 LTS	linux-hwe-6.8	6.8.0-149.149~22.04.1	USN-9066-1
Ubuntu 22.04 LTS	linux-ibm-6.8	6.8.0-1066.67~22.04.1	USN-8906-1
Ubuntu 22.04 LTS	linux-lowlatency-hwe-6.8	6.8.0-146.146.1~22.04.1	USN-8903-2
Ubuntu 22.04 LTS	linux-nvidia-6.8	6.8.0-1064.67~22.04.1	USN-8903-2
Ubuntu 22.04 LTS	linux-oracle-6.8	6.8.0-1067.71~22.04.1	USN-9025-1
Ubuntu 22.04 LTS	linux-riscv +32	No fix yet	—
Ubuntu 22.04 LTS	linux-riscv-6.8	6.8.0-146.146~22.04.1	—
Ubuntu 20.04 LTS	linux-gke +28	No fix yet	—

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	linux-gcp +14	No fix yet	—
Ubuntu 16.04 LTS	linux-hwe-edge	No fix yet	—
Ubuntu Pro Realtime 24.04 LTS	linux-raspi-realtime	6.8.0-2056.58	USN-9025-1
Ubuntu Pro Realtime 24.04 LTS	linux-realtime	6.8.1-1061.62	USN-8903-1
Ubuntu Pro Realtime 24.04 LTS	linux-realtime-6.14	No fix yet	—
Ubuntu Pro Realtime 22.04 LTS	linux-realtime-6.8	6.8.1-1061.62~22.04.1	USN-8903-1
Ubuntu Pro FIPS-updates 24.04 LTS	linux-aws-fips	6.8.0-1066.69+fips1	USN-8903-1
Ubuntu Pro FIPS-updates 24.04 LTS	linux-azure-fips	6.8.0-1069.77+fips1	USN-8904-1
Ubuntu Pro FIPS-updates 24.04 LTS	linux-fips	6.8.0-146.146+fips1	USN-8903-1
Ubuntu Pro FIPS-updates 24.04 LTS	linux-gcp-fips	6.8.0-1070.78+fips1	USN-8905-1

Advisories 17

USN-9025-1 linux-oracle-6.8, linux-raspi, linux-raspi-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
USN-8903-2 linux-gke, linux-gkeop, linux-ibm, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
USN-8593-1 linux-ibm, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
USN-9066-1 linux-hwe-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
USN-8903-1 linux, linux-aws, linux-aws-6.8, linux-aws-fips, linux-fips, linux-realtime, linux-realtime-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
USN-8663-1 linux-nvidia, linux-nvidia-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
USN-8728-1 linux-gcp-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
USN-8904-1 linux-azure, linux-azure-6.8, linux-azure-fde, linux-azure-fde-6.8, linux-azure-fips vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
USN-8906-1 linux-ibm-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
USN-8905-1 linux-gcp-6.8, linux-gcp-fips vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
USN-8905-2 linux-gcp vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
USN-8618-1 linux-aws, linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
USN-8728-3 linux-oracle-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
USN-8728-2 linux-azure-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
USN-8664-1 linux-nvidia-bos vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
WID-SEC-2026-2403 Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Nov 12, 2026
USN-8886-1 linux-nvidia-tegra vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026

References