{"id":"CVE-2026-72382","summary":"ksmbd: reject undersized DACLs before parsing ACEs","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: reject undersized DACLs before parsing ACEs\n\nparse_dacl() limits the attacker-controlled ACE count by comparing it\nwith the number of minimal ACEs that fit in the DACL size. The DACL size\nfield is 16 bits, but the expression subtracts sizeof(struct smb_acl).\nBecause sizeof() is unsigned, a DACL size smaller than the ACL header\nunderflows to a large size_t.\n\nA malicious client can reach this with:\n\nSMB2_SET_INFO (InfoType=SMB2_O_INFO_SECURITY)\n  -\u003e smb2_set_info_sec()\n  -\u003e set_info_sec()\n  -\u003e parse_sec_desc()\n  -\u003e parse_dacl()\n     -\u003e init_acl_state(..., 0xffff)\n     -\u003e init_acl_state(..., 0xffff)\n     -\u003e kmalloc_objs(..., 0xffff)\n\nThus a malformed security descriptor can make num_aces pass the guard\nand drive large temporary ACL state and pointer-array allocations.\n\nReject DACLs smaller than struct smb_acl before doing the subtraction,\nso the ACE count check cannot be bypassed by the underflow.","modified":"2026-08-16T03:48:27.776975305Z","published":"2026-08-15T05:56:14.103Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72382.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/15a9e9b8f7f5d7f380ae54c6f5bcbc0bdcb0f3cd"},{"type":"WEB","url":"https://git.kernel.org/stable/c/16fb65ec15fe7c90f50a2115854bfd9a032d4023"},{"type":"WEB","url":"https://git.kernel.org/stable/c/282847c0cf22f2e961155ac8e42f6eeab7e16049"},{"type":"WEB","url":"https://git.kernel.org/stable/c/60908f7ebcd9b6cde74ad5711fab0f49c7970949"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d020e7f27bf65eecd3805404702f716b2b6d9e73"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72382.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72382"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9"},{"fixed":"16fb65ec15fe7c90f50a2115854bfd9a032d4023"},{"fixed":"282847c0cf22f2e961155ac8e42f6eeab7e16049"},{"fixed":"d020e7f27bf65eecd3805404702f716b2b6d9e73"},{"fixed":"15a9e9b8f7f5d7f380ae54c6f5bcbc0bdcb0f3cd"},{"fixed":"60908f7ebcd9b6cde74ad5711fab0f49c7970949"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72382.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.15.0"},{"fixed":"6.6.145"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.97"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.40"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72382.json"}}],"schema_version":"1.9.0"}