The Linux kernel's ksmbd module had a regression introduced by commit d07b26f39246, which incorrectly implemented a bounds check in smb_check_perm_dacl(). The check compared aces_size against a constant in a way that always evaluated false, effectively disabling the loop break condition. This caused the code to read the ace->size field even when the buffer was smaller than required, leading to a 2-byte heap out-of-bounds read during SMB2_CREATE operations. The fix involved correcting the comparison to ensure the buffer is at least 16 bytes, preventing the OOB read.

This vulnerability allows an out-of-bounds read of 2 bytes on the heap during SMB2_CREATE operations in the Linux kernel's ksmbd service. While the impact is limited to a small memory read, such OOB reads can potentially lead to information disclosure or memory corruption depending on context. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The issue was fixed by correcting the bounds check in the kernel source. Users should monitor official Linux kernel advisories for patches addressing CVE-2026-63909 and apply them when available.