CVE-2026-72382

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An integer underflow exists in the ksmbd component. The parse dacl() function attempts to limit the attacker-controlled Access Control Entry (ACE) count by comparing it with the number of minimal ACEs that fit within the Discretionary Access Control List (DACL) size. Because the DACL size field is 16 bits and the subtraction of sizeof(struct smb acl) uses an unsigned value, a DACL size smaller than the ACL header causes an underflow to a large size t value. A malicious client can exploit this by sending a malformed security descriptor via the SMB2 SET INFO endpoint with InfoType set to SMB2 O INFO SECURITY. This allows the num aces variable to bypass security checks, leading to excessive memory allocations for temporary ACL state and pointer arrays through the init acl state() and kmalloc objs() functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.