{"id":"CVE-2026-90153","published":"2026-09-17T17:17:08.370","lastModified":"2026-09-18T18:17:44.427","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: bound smb_check_perm_dacl() ACE walks by DACL size\n\nsmb_check_perm_dacl() validates that the DACL fits inside the NT\nsecurity descriptor, but then bounds its two ACE walks by the\nremaining NTSD length (acl_size) rather than the DACL's declared\nsize (pdacl_size).\n\nWhen pdacl->size is smaller than the trailing NTSD buffer, bytes\nafter the declared DACL boundary - still inside the stored security\ndescriptor - are parsed as ACEs during access checks.  A crafted\nDACL can place an access-granting ACE beyond pdacl->size, and the\ncurrent code accepts it during SMB2_CREATE access validation, while\nparse_dacl() and smb_inherit_dacl() stop at pdacl_size.\n\nBound both ACE walks by pdacl_size to match the DACL boundary\nsemantics used elsewhere in the server.\n\nValidation:\n- semantic KUnit harness shows the post-boundary ACE is selected\n  before the fix and rejected (EACCES) after it\n- linux master (7.2-rc6), x86_64","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/79decd88dd3f0d42e7fb0689b1a7853bfa302459","tags":[]},{"url":"https://git.kernel.org/stable/c/8e4f75e979c1d9a51b0a48ac33d0cfd5f039ec67","tags":[]},{"url":"https://git.kernel.org/stable/c/a2051ffe452afad52f580b85a3fd8851933b1e7c","tags":[]},{"url":"https://git.kernel.org/stable/c/a29f57a14c939586d84d7fd6a029bd1fd170098f","tags":[]},{"url":"https://git.kernel.org/stable/c/a4a307d149327dad5fb25187e1b03cebd1b04de6","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}