From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D825C3783A0 for ; Sat, 15 Aug 2026 06:27:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786775245; cv=none; b=DF2PBclpJnDwHN3BdwMygFHIqhvAnmqfBHq3Z97qbsCLsGxPY8TkXVZCzKEXXMvQehgmHewQWVP6aJnEnFfpGEPU7oVwRcaIpgKYq6Huyac8fIAI7ugiENkuKiC/sHsVkNPIQQoosiY09QWh661rCwg116zz/YZFdsUWbNcWv5E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786775245; c=relaxed/simple; bh=oRWlNuhDQ2aaysB8MBieAoR7PvuvvNu+cOu3HN5IJCU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Z0Otm02d9i7JWaTSVoLxquEEgwPF7m8vzOgFl2U0FSzcjNuPtGSZgOCRli5/El+AbcXTM4yVrN9b30NmsjWxU5rEfh3Q1/tfEnyVPYdzLna59yoHJesZJNKp/vhooSt9IET1isCQm71PVGgv7Fb/q7pHNUSUTNwQHppDt1lGunM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=mTiLwBVU; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="mTiLwBVU" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3822A1F000E9; Sat, 15 Aug 2026 06:27:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786775243; bh=i4rkLaZimr26+fKUZp402zNm0vBMZ7pm42gtSWIiq4w=; h=From:To:Cc:Subject:Date:Reply-To; b=mTiLwBVU+MfkbRsBRZFhkS85OPAt8NJMf2x6nfuo1g1/8du33kZMqe+IEXS2mdaRN v7DapwTt6ip0Ui5/r0l/vAHREObFMO4VNjMRrwJDWAG46wcbNkpJpBFtX9BkUlqGSW N9iLLMXFg96teOcx7Y0GOVRE2vRP2wfyI732epwA= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-72382: ksmbd: reject undersized DACLs before parsing ACEs Date: Sat, 15 Aug 2026 15:07:41 +0900 Message-ID: <2026081518-CVE-2026-72382-aa5f@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3328; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=saUAEzuT4qORI2RoNRckkb2KbAQyeZAoYU622n6sb1c=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkNDK9+bVa5ff19jpjRkZaC6brl5rE2zwJ3tK/7KP7iX 2mmiKh1RywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEzE6RLDPG2hGXd8WFOkbrOK G977rO2iUiWUx7BgrdiKvAMJa211Lresad6QJyJ08stEAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parse_dacl() limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression subtracts sizeof(struct smb_acl). Because sizeof() is unsigned, a DACL size smaller than the ACL header underflows to a large size_t. A malicious client can reach this with: SMB2_SET_INFO (InfoType=SMB2_O_INFO_SECURITY) -> smb2_set_info_sec() -> set_info_sec() -> parse_sec_desc() -> parse_dacl() -> init_acl_state(..., 0xffff) -> init_acl_state(..., 0xffff) -> kmalloc_objs(..., 0xffff) Thus a malformed security descriptor can make num_aces pass the guard and drive large temporary ACL state and pointer-array allocations. Reject DACLs smaller than struct smb_acl before doing the subtraction, so the ACE count check cannot be bypassed by the underflow. The Linux kernel CVE team has assigned CVE-2026-72382 to this issue. Affected and fixed versions =========================== Issue introduced in 5.15 with commit e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 and fixed in 6.6.145 with commit 16fb65ec15fe7c90f50a2115854bfd9a032d4023 Issue introduced in 5.15 with commit e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 and fixed in 6.12.97 with commit 282847c0cf22f2e961155ac8e42f6eeab7e16049 Issue introduced in 5.15 with commit e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 and fixed in 6.18.40 with commit d020e7f27bf65eecd3805404702f716b2b6d9e73 Issue introduced in 5.15 with commit e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 and fixed in 7.1.5 with commit 15a9e9b8f7f5d7f380ae54c6f5bcbc0bdcb0f3cd Issue introduced in 5.15 with commit e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 and fixed in 7.2-rc2 with commit 60908f7ebcd9b6cde74ad5711fab0f49c7970949 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-72382 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/smb/server/smbacl.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/16fb65ec15fe7c90f50a2115854bfd9a032d4023 https://git.kernel.org/stable/c/282847c0cf22f2e961155ac8e42f6eeab7e16049 https://git.kernel.org/stable/c/d020e7f27bf65eecd3805404702f716b2b6d9e73 https://git.kernel.org/stable/c/15a9e9b8f7f5d7f380ae54c6f5bcbc0bdcb0f3cd https://git.kernel.org/stable/c/60908f7ebcd9b6cde74ad5711fab0f49c7970949