CVE-2026-53390: Linux Kernel Privilege Escalation Flaw

CVE-2026-53390 Overview

CVE-2026-53390 is a heap out-of-bounds read vulnerability in the Linux kernel's ksmbd in-kernel SMB server. The flaw lives in smb_check_perm_dacl(), which walks Access Control Entries (ACEs) during permission checks. The function validates the ACE header size and caps sid.num_subauth at SID_MAX_SUB_AUTHORITIES, but it never verifies that ace->size is large enough to hold the declared number of sub-authorities. An authenticated remote client on a share that uses ACL xattrs can trigger the read. The Linux kernel maintainers have merged fixes across multiple stable branches.

Critical Impact
An authenticated attacker can trigger a heap out-of-bounds read of up to SID_MAX_SUB_AUTHORITIES * sizeof(__le32) bytes past the security descriptor allocation, leading to information disclosure or kernel denial of service.

Affected Products

Linux kernel ksmbd in-kernel SMB server
Linux distributions shipping vulnerable stable kernel branches prior to the fix commits
SMB shares configured with ACL xattr support (security.NTACL)

Discovery Timeline

2026-07-19 - CVE-2026-53390 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-53390

Vulnerability Analysis

The vulnerability sits in smb_check_perm_dacl(), the ksmbd routine that walks the Discretionary Access Control List (DACL) during SMB2 access checks. The function enforces two bounds. It confirms the ACE header size against offsetof(struct smb_ace, sid) and caps sid.num_subauth at SID_MAX_SUB_AUTHORITIES. Neither check ties num_subauth back to the actual ACE size on the wire.

CIFS_SID_BASE_SIZE covers only the 8-byte SID header up to but excluding the sub_auth[] array. As a result, the existing guards permit an ACE that declares sub-authorities without actually storing them. compare_sids() then reads ace->sid.sub_auth[i] for i < min(local_sid->num_subauth, ace->sid.num_subauth).

The local comparison SIDs used by ksmbd (sid_everyone, sid_unix_NFS_mode, and the id_to_sid() result) always define at least one sub-authority. An attacker controls the ACE revision and authority bytes that reside inside the in-bounds SID base, so a crafted ACE matches one of these local SIDs and forces the sub_auth dereference past the buffer.

Root Cause

The root cause is a missing bounds check tying num_subauth to the actual ace->size. ksmbd_vfs_get_sd_xattr() loads the descriptor into a buffer sized exactly to the on-disk data via kzalloc(sd_size) in ndr_decode_v4_ntacl(). A malformed ACE with size == 16 and num_subauth >= 1 placed at the tail of the descriptor therefore causes reads to land past the allocation. Sibling parsers parse_dacl() and smb_inherit_dacl() already enforce the correct guard.

Attack Vector

An authenticated SMB client writes the malformed security descriptor verbatim to the security.NTACL xattr via SMB2_SET_INFO, because ksmbd does not normalise the DACL before storage. The out-of-bounds read then fires on a subsequent SMB2_CREATE access check against that object. Exploitation requires only low-privileged authenticated access to a share that uses ACL xattrs, no user interaction, and yields either kernel memory disclosure or service disruption.

No public proof-of-concept is currently linked in the CVE data. Technical details are available in the upstream fix commits, including Kernel Git Commit 1ef0600 and Kernel Git Commit e36e356.

Detection Methods for CVE-2026-53390

Indicators of Compromise

Anomalous SMB2_SET_INFO requests targeting security.NTACL xattrs with malformed DACL blobs
ACE structures observed on the wire with size == 16 and num_subauth >= 1
Kernel warnings, KASAN splats, or oops reports referencing smb_check_perm_dacl or compare_sids
Unexpected ksmbd process crashes on shares configured with ACL xattrs

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to surface the out-of-bounds read during fuzzing of SMB2 access-check paths
Inspect stored security.NTACL xattrs on shares for ACEs where the declared num_subauth cannot fit within ace->size
Correlate authenticated SMB sessions issuing SET_INFO followed by CREATE operations against the same object within short time windows

Monitoring Recommendations

Collect and forward ksmbd kernel logs to a centralised logging pipeline for kernel oops and KASAN events
Monitor SMB audit trails for authenticated write access to shares that expose ACL xattrs
Track kernel version inventory across Linux hosts running ksmbd to confirm patch state

How to Mitigate CVE-2026-53390

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the CVE and rebuild or update to the fixed kernel package for your distribution
Disable the ksmbd module on hosts that do not require an in-kernel SMB server using modprobe -r ksmbd and blacklist the module
Restrict SMB share access to trusted authenticated users and remove write access to shares that use ACL xattrs where feasible
Audit configured shares for vfs objects or equivalents that enable security.NTACL xattr storage

Patch Information

The fix adds the missing num_subauth-versus-ace_size check in smb_check_perm_dacl(), mirroring the guards already present in parse_dacl() and smb_inherit_dacl(). Merged commits are available across multiple stable branches: Kernel Git Commit 1ef0600, Kernel Git Commit 3659989, Kernel Git Commit 7627ff8, Kernel Git Commit 988c93d, Kernel Git Commit c7488c8, Kernel Git Commit d5c81a0, and Kernel Git Commit e36e356.

Workarounds

Unload and blacklist the ksmbd module on systems that do not require kernel-mode SMB serving
Switch affected file services to a userspace SMB implementation such as Samba until patched kernels are deployed
Block SMB access from untrusted networks at the perimeter to reduce exposure to authenticated attackers

bash

# Disable and blacklist the ksmbd module until a patched kernel is installed
sudo systemctl stop ksmbd.service 2>/dev/null || true
sudo modprobe -r ksmbd
echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf
sudo depmod -a