CVE-2026-90153

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ksmbd module where the smb check perm dacl() function incorrectly bounds its Access Control Entry (ACE) walks by the remaining NT security descriptor (NTSD) length (acl size) instead of the declared Discretionary Access Control List (DACL) size (pdacl size). This discrepancy allows bytes located after the declared DACL boundary, but still within the stored security descriptor, to be parsed as ACEs during access checks. Consequently, a crafted DACL can include an access-granting ACE beyond the pdacl size that is accepted during SMB2 CREATE access validation, bypassing the boundary semantics used by parse dacl() and smb inherit dacl().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.