{
  "cveId": "CVE-2026-53390",
  "url": "https://patchblox.com/security/cve/CVE-2026-53390",
  "summary": "CVE-2026-53390 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-53390, released July 20, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix out-of-bounds read in smb_check_perm_...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix out-of-bounds read in smb_check_perm_dacl()  The permission-check ACE walk in smb_check_perm_dacl() validates the ACE header size and caps sid.num_subauth at SID_MAX_SUB_AUTHORITIES, but it never checks that ace-\u003Esize is actually large enough to contain num_subauth sub-authorities before compare_sids() dereferences them.  CIFS_SID_BASE_SIZE covers the SID header up to but excluding the sub_auth[] array, and offsetof(struct smb_ace, sid) is the ACE header, so the existing guards only guarantee the 8-byte SID base, i.e. zero sub-authorities. compare_sids() then reads ace-\u003Esid.sub_auth[i] for i \u003C min(local_sid-\u003Enum_subauth, ace-\u003Esid.num_subauth). The local comparison SIDs (sid_everyone, sid_unix_NFS_mode, and the id_to_sid() result) always have at least one sub-authority, and an attacker controls the ACE revision and authority bytes (which lie within the in-bounds SID base), so they can match one of those SIDs and force the sub_auth read.  A crafted ACE with size == 16 and num_subauth \u003E= 1 placed at the tail of the security descriptor therefore causes a heap out-of-bounds read of up to SID_MAX_SUB_AUTHORITIES * sizeof(__le32) bytes past the pntsd allocation. The security descriptor is loaded by ksmbd_vfs_get_sd_xattr() into a buffer sized exactly to the on-disk data (kzalloc(sd_size) in ndr_decode_v4_ntacl()), so the read lands past the allocation. The malformed descriptor can be stored verbatim via SMB2_SET_INFO (the DACL is not normalised before being written to the security.NTACL xattr) and the read fires on a subsequent SMB2_CREATE access check, making this reachable by an authenticated client on a share that uses ACL xattrs.  Add the missing num_subauth-versus-ace_size check, mirroring the identical guards already present in the sibling parsers parse_dacl() and smb_inherit_dacl().",
  "published": "2026-07-19T12:16:50Z",
  "severity": "high",
  "cvss": 8.1,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
  "epss": 0.0047,
  "epssPercentile": 0.40881,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.177-1",
      "fix": "DEBIAN-CVE-2026-53390",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-53390",
      "released": "2026-07-20T12:58:36Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.95-1",
      "fix": "DEBIAN-CVE-2026-53390",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-53390",
      "released": "2026-07-20T12:58:36Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.3-1",
      "fix": "DEBIAN-CVE-2026-53390",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-53390",
      "released": "2026-07-20T12:58:36Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}