CVE-2026-63909: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-63909 Overview

CVE-2026-63909 is an out-of-bounds read vulnerability in the Linux kernel's ksmbd in-kernel SMB server. The flaw resides in the smb_check_perm_dacl() function, which handles Access Control Entry (ACE) walk loops during SMB2_CREATE operations. A prior patch (d07b26f39246) introduced a transposed bounds check that evaluates to aces_size < 0, becoming dead code and removing the previous 4-byte guard. Authenticated remote attackers reaching the SMB service can trigger a 2-byte heap out-of-bounds read past the pntsd allocation.

Critical Impact
Authenticated remote attackers can trigger a heap out-of-bounds read in the Linux kernel, exposing adjacent kernel heap memory contents and potentially causing kernel instability or denial of service on systems exporting SMB shares via ksmbd.

Affected Products

Linux kernel versions containing commit d07b26f39246 ("ksmbd: require minimum ACE size in smb_check_perm_dacl()")
Systems using the ksmbd in-kernel SMB3 server for file sharing
Distributions shipping affected stable kernel branches prior to backport of the fix

Discovery Timeline

2026-07-19 - CVE-2026-63909 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63909

Vulnerability Analysis

The vulnerability sits in the ksmbd kernel module, which implements an SMB3 file server directly in kernel space. During SMB2_CREATE processing, smb_check_perm_dacl() walks the Discretionary Access Control List (DACL) contained in a Security Descriptor pointer (pntsd). Each iteration must validate that the remaining buffer holds a full struct smb_ace before dereferencing its fields.

Exploitation requires an authenticated SMB session, since ksmbd enforces authentication before parsing security descriptors on create requests. Once inside the loop, an attacker who supplies a malformed or truncated ACL causes the parser to read ace->size at offset 2 of memory that extends past the allocation. The result is a 2-byte adjacent heap read that leaks kernel heap contents into the ACE-walk logic and, depending on the surrounding slab layout, can produce parsing errors or KASAN reports.

This class of flaw is tracked as an Out-of-Bounds Read and typically maps to CWE-125. The impact profile is confidentiality loss of adjacent kernel memory and availability impact through kernel warnings or oopses under KASAN-enabled builds.

Root Cause

Commit d07b26f39246 introduced a transposed comparison:

if (offsetof(struct smb_ace, sid) + aces_size < CIFS_SID_BASE_SIZE)

Both offsetof(struct smb_ace, sid) and CIFS_SID_BASE_SIZE equal 8, reducing the check to aces_size < 0. Because aces_size is an unsigned or non-negative quantity, the condition is never true, and the guard becomes dead code. The same commit removed the previous 4-byte length check, so the loop now dereferences ace->size even when only 0-3 bytes remain in the buffer. The corrected form, matching smb_inherit_dacl(), requires at least 16 bytes (8-byte ACE header offset plus 8-byte SID base) before continuing the walk.

Attack Vector

An attacker requires network reachability to the SMB service on TCP/445 and valid credentials for any share exported by ksmbd. After establishing a session, the attacker sends a crafted SMB2_CREATE request whose associated Security Descriptor contains an ACL region truncated to 0-3 bytes. The ACE-walk loop reads past the allocation, yielding the out-of-bounds condition. No user interaction is required beyond issuing the SMB request. The vulnerability is not confirmed exploited in the wild and no public proof-of-concept is listed.

No verified exploit code is available. Refer to the upstream stable commits linked in the references for the corrected bounds-check implementation.

Detection Methods for CVE-2026-63909

Indicators of Compromise

Kernel log entries containing KASAN: slab-out-of-bounds referencing smb_check_perm_dacl in the call stack
Repeated ksmbd warning messages or oopses tied to SMB2_CREATE handling on hosts exporting shares
Authenticated SMB sessions from unexpected sources issuing high volumes of malformed CREATE requests with unusual Security Descriptor payloads

Detection Strategies

Monitor dmesg and journald for ksmbd stack traces referencing smb_check_perm_dacl, build_sec_desc, or parse_sec_desc
Inspect SMB traffic for SMB2_CREATE requests carrying Security Descriptors whose ACL size fields are smaller than 16 bytes
Correlate authentication events against ksmbd shares with subsequent kernel warnings to identify probing behavior

Monitoring Recommendations

Enable KASAN on non-production kernels running ksmbd to surface the OOB read during testing and fuzzing
Forward kernel logs from SMB-exporting hosts to a centralized log platform for real-time alerting on ksmbd errors
Track the kernel version and patch level of Linux SMB servers to confirm the fix commits are applied

How to Mitigate CVE-2026-63909

Immediate Actions Required

Update affected Linux kernels to a stable release containing one of the fix commits: 0e60dafe, 0fe08c57, 4f7c131d, 5500ba1d, 94215d55, d333af32, or f6324b42
Restrict network access to TCP/445 on ksmbd hosts to trusted management segments until patches are deployed
Audit ksmbd share permissions and disable anonymous or low-value accounts that could be leveraged to reach the vulnerable code path

Patch Information

The upstream fix restores the correct comparison, requiring offsetof(struct smb_ace, sid) + CIFS_SID_BASE_SIZE bytes before dereferencing ace->size, matching the form used by smb_inherit_dacl(). Stable backports are available in the kernel.org commits listed in the Kernel Commit 0e60dafe, Kernel Commit 0fe08c57, Kernel Commit 4f7c131d, Kernel Commit 5500ba1d, Kernel Commit 94215d55, Kernel Commit d333af32, and Kernel Commit f6324b42 references. Apply distribution-provided kernel updates once available.

Workarounds

Unload the ksmbd kernel module and migrate to userspace Samba (smbd) where SMB service is required but the patch cannot be applied immediately
Block inbound TCP/445 at the host firewall or upstream network device on systems that do not need to export SMB shares
Enforce strong authentication and remove guest or unprivileged accounts from ksmbd shares to raise the bar for reaching the vulnerable code path

bash

# Disable and unload the ksmbd module until the kernel is patched
sudo systemctl stop ksmbd.service
sudo systemctl disable ksmbd.service
sudo modprobe -r ksmbd

# Block SMB at the host firewall (nftables example)
sudo nft add rule inet filter input tcp dport 445 drop

# Verify running kernel version after patching
uname -r