{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-63909", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-63909" ], "published": "2026-07-19T14:56:29Z", "summary": "ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops\n\nCommit d07b26f39246 (\"ksmbd: require minimum ACE size in\nsmb_check_perm_dacl()\") introduced a transposed bounds check:\n\n if (offsetof(struct smb_ace, sid) + aces_size < CIFS_SID_BASE_SIZE)\n\nSince offsetof(..sid) is 8 and CIFS_SID_BASE_SIZE is 8, this evaluates\nto `aces_size < 0`. Because `aces_size` is always non-negative, this\ncheck becomes dead code and never breaks the loop.\n\nWorse, that commit removed the old 4-byte guard, meaning the loop now\nreads `ace->size` (offset 2) even when `aces_size` is 0-3 bytes. This\nre-opens a 2-byte heap out-of-bounds (OOB) read past the pntsd allocation\nduring subsequent SMB2_CREATE operations.\n\nFix this by properly transposing the comparison to require at least\n16 bytes (8-byte offset + 8-byte SID base), matching the correct form\nused in smb_inherit_dacl().", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.12.87-1+rpt1~bookworm" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.12.87+rpt-rpi-2712", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v6", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v7", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v7l", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v8", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v8-rt", "binary_version": "1:6.12.87-1+rpt1~bookworm" } ] }, "database_specific": { "per_version": { "1:6.12.87-1+rpt1~bookworm": { "linux_commit": "ae4d75fb36deba0fe1a986d9bfae65755e082dd0", "upstream_version": "6.12.87", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.93" } } } }, { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.18.29-1+rpt1", "1:6.18.33-1+rpt1", "1:6.18.34-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.18.29+rpt-rpi-2712", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v6", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v7", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8-rt", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-2712", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v6", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v7", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8-rt", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-2712", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v6", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v7", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8-rt", "binary_version": "1:6.18.34-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.18.29-1+rpt1": { "linux_commit": "66318c5b5cd8145a662303af12ed39ac07eb27cc", "upstream_version": "6.18.29", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.35" }, "1:6.18.33-1+rpt1": { "linux_commit": "95b85bebbedcaedfa7ca79116ed38b7376fba412", "upstream_version": "6.18.33", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.35" }, "1:6.18.34-1+rpt1": { "linux_commit": "c8c7494100e99ee05b11aaa4f0588a223a63d1af", "upstream_version": "6.18.34", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.35" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63909" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/5500ba1d410aed1eded3eb04a76b10cfb4409334" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/f6324b4240cf0b26a84c33f68a1222d727ff4af2" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/0fe08c5776a798f46df1fd74b331be26bdd644d6" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/d333af32e4451285e427f2d9c29de3a39f6f6d48" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/94215d55b09445993929f4fc966061d61de74929" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/4f7c131d2bdd7cd64b96f60d10be5ea72253f520" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/0e60dafe97eca61721f3db456f97d97a80c6c8ae" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-05T13:16:28Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 8.1, "cvss_v3_severity": "High", "scenario": "AV:N - The bug is reachable through ksmbd's in-kernel SMB server on TCP port 445; a remote attacker sends crafted SMB2 packets that traverse the normal network receive path to smb_check_perm_dacl().\nAC:L - The attacker fully controls the crafted NTSD/DACL planted via SMB and the subsequent SMB2_CREATE that triggers the walk; no race or victim-specific memory layout is required beyond standard heap behavior.\nPR:L - Exploitation requires an authenticated SMB2 session (post SESSION_SETUP and TREE_CONNECT) with permission to create files and set security descriptors (WRITE_DAC) on a share with ACL xattr support; this is a low-privileged authenticated user, not an unauthenticated attacker.\nUI:N - No end-user interaction is required beyond the attacker operating their own SMB client against an exposed ksmbd server.\nS:U - The vulnerability is a kernel heap out-of-bounds read within ksmbd's own security context; it does not cross a VM, sandbox, or IOMMU security boundary.\nC:H - The bug is an out-of-bounds heap read of ace->size past the pntsd kmalloc allocation; per kernel guidance OOB reads warrant High confidentiality impact as adjacent heap metadata or pointers may be disclosed.\nI:N - This is a read-only out-of-bounds access with no memory write, type confusion, or demonstrated ability to modify kernel data or achieve code execution through the corrupted read path.\nA:H - Reading beyond the kmalloc boundary can trigger a kernel page fault, oops, or panic; the original fix commit also notes KASAN reports and possible kernel state corruption from the OOB access." } } }