In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Commit… (CVE-2026-63909)
In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Commit d07b26f39246 ("ksmbd: require minimum ACE size in smb_check_perm_dacl()") introduced a transposed bounds check: if (offsetof(struct smb_ace, sid) + aces_size < CIFS_SID_BASE_SIZE) Since offsetof(..sid) is 8 and CIFS_SID_BASE_SIZE is 8, this evaluates to `aces_size < 0`. Because `aces_size` is always non-negative, this check becomes dead code and never breaks the loop. Worse, that commit removed the old 4-byte guard, meaning the loop now reads `ace->size` (offset 2) even when `aces_size` is 0-3 bytes. This re-opens a 2-byte heap out-of-bounds (OOB) read past the pntsd allocation during subsequent SMB2_CREATE operations. Fix this by properly transposing the comparison to require at least 16 bytes (8-byte offset + 8-byte SID base), matching the correct form used in smb_inherit_dacl().
AI Analysis
Technical Summary
The Linux kernel's ksmbd module had a regression introduced by commit d07b26f39246, which incorrectly implemented a bounds check in smb_check_perm_dacl(). The check compared aces_size against a constant in a way that always evaluated false, effectively disabling the loop break condition. This caused the code to read the ace->size field even when the buffer was smaller than required, leading to a 2-byte heap out-of-bounds read during SMB2_CREATE operations. The fix involved correcting the comparison to ensure the buffer is at least 16 bytes, preventing the OOB read.
Potential Impact
This vulnerability allows an out-of-bounds read of 2 bytes on the heap during SMB2_CREATE operations in the Linux kernel's ksmbd service. While the impact is limited to a small memory read, such OOB reads can potentially lead to information disclosure or memory corruption depending on context. No known exploits are reported in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The issue was fixed by correcting the bounds check in the kernel source. Users should monitor official Linux kernel advisories for patches addressing CVE-2026-63909 and apply them when available.
In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Commit… (CVE-2026-63909)
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Commit d07b26f39246 ("ksmbd: require minimum ACE size in smb_check_perm_dacl()") introduced a transposed bounds check: if (offsetof(struct smb_ace, sid) + aces_size < CIFS_SID_BASE_SIZE) Since offsetof(..sid) is 8 and CIFS_SID_BASE_SIZE is 8, this evaluates to `aces_size < 0`. Because `aces_size` is always non-negative, this check becomes dead code and never breaks the loop. Worse, that commit removed the old 4-byte guard, meaning the loop now reads `ace->size` (offset 2) even when `aces_size` is 0-3 bytes. This re-opens a 2-byte heap out-of-bounds (OOB) read past the pntsd allocation during subsequent SMB2_CREATE operations. Fix this by properly transposing the comparison to require at least 16 bytes (8-byte offset + 8-byte SID base), matching the correct form used in smb_inherit_dacl().
CVSS v3.1
Score 8.1high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's ksmbd module had a regression introduced by commit d07b26f39246, which incorrectly implemented a bounds check in smb_check_perm_dacl(). The check compared aces_size against a constant in a way that always evaluated false, effectively disabling the loop break condition. This caused the code to read the ace->size field even when the buffer was smaller than required, leading to a 2-byte heap out-of-bounds read during SMB2_CREATE operations. The fix involved correcting the comparison to ensure the buffer is at least 16 bytes, preventing the OOB read.
Potential Impact
This vulnerability allows an out-of-bounds read of 2 bytes on the heap during SMB2_CREATE operations in the Linux kernel's ksmbd service. While the impact is limited to a small memory read, such OOB reads can potentially lead to information disclosure or memory corruption depending on context. No known exploits are reported in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The issue was fixed by correcting the bounds check in the kernel source. Users should monitor official Linux kernel advisories for patches addressing CVE-2026-63909 and apply them when available.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-77x3-ghg7-w5wj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-63909"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a5d27ab2a4a8d598912f91c
Added to database: 07/19/2026, 19:38:19 UTC
Last enriched: 07/19/2026, 20:09:54 UTC
Last updated: 09/02/2026, 22:52:13 UTC
Views: 79
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.