The Linux kernel's ksmbd module had a vulnerability (CVE-2026-53390) where smb_check_perm_dacl() performed an out-of-bounds read. Although it validated the ACE header size and capped the number of sub-authorities, it failed to ensure the ACE size was sufficient to hold all sub-authorities before compare_sids() accessed them. This allowed a crafted ACE with minimal size but a declared number of sub-authorities to cause a heap out-of-bounds read past the allocated security descriptor buffer. The malformed ACE can be stored via SMB2_SET_INFO and triggered on subsequent SMB2_CREATE access checks by an authenticated client on shares using ACL xattrs. The fix involved adding the missing check to ensure the ACE size covers all sub-authorities, aligning with existing safeguards in related parsers.

An authenticated client with access to an SMB share that uses ACL extended attributes can trigger a heap out-of-bounds read in the kernel during permission checks. This could potentially lead to information disclosure or kernel instability. However, no known exploits in the wild have been reported. The vulnerability affects the ksmbd component of the Linux kernel and requires authenticated access to a vulnerable share.

A fix has been implemented in the Linux kernel to add the missing validation check for ACE size against the number of sub-authorities in smb_check_perm_dacl(). Users and administrators should apply the official Linux kernel updates that include this patch. Since this is not a cloud service, remediation depends on applying the updated kernel version. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the specific fixed versions and update accordingly.