CVE-2026-63909

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the smb check perm dacl() function within the ksmbd module. This issue occurs during ACE-walk loops when a transposed bounds check fails to properly validate the aces size variable. Specifically, the check evaluates to aces size < 0, which is always false since aces size is non-negative, rendering the check dead code. This allows the loop to read ace->size even when aces size is between 0 and 3 bytes, resulting in a 2-byte heap out-of-bounds read past the pntsd allocation during SMB2 CREATE operations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.