The vulnerability in Linux ksmbd (CVE-2026-8449) is a heap out-of-bounds read caused by improper handling of a malformed discretionary access control list (DACL) SID with an inflated num_subauth field during ACL inheritance. Remote attackers with directory creation permissions can exploit this by creating a directory, setting the malicious DACL via SMB2_SET_INFO, and then creating child entries, triggering heap corruption. This can result in kernel instability, denial of service, or potentially privilege escalation through kernel code execution. The CVSS 3.1 score is 8.8, reflecting high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

Successful exploitation can cause kernel instability and denial of service, disrupting system availability. Additionally, it may allow attackers to escalate privileges to execute code in kernel mode, compromising system integrity and confidentiality. The vulnerability requires remote access with directory creation permissions but does not require user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict directory creation permissions to trusted users only and monitor for unusual SMB activity related to ACL modifications. Avoid exposing ksmbd services to untrusted networks where possible.