Answer in brief
CVE-2026-90153 records a High severity (CVSS 8.1) vulnerability in ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=8f0541186e9ad1b62accc9519cc2b7a7240272a7 <a2051ffe452afad52f580b85a3fd8851933b1e7c || >=8f0541186e9ad1b62accc9519cc2b7a7240272a7 <a29f57a14c939586d84d7fd6a029bd1fd170098f || >=8f0541186e9ad1b62accc9519cc2b7a7240272a7 <a4a307d149327dad5fb25187e1b03cebd1b04de6 || >=8f0541186e9ad1b62accc9519cc2b7a7240272a7 <8e4f75e979c1d9a51b0a48ac33d0cfd5f039ec67 || >=8f0541186e9ad1b62accc9519cc2b7a7240272a7 <79decd88dd3f0d42e7fb0689b1a7853bfa302459 || cb69d4d6f709f87c94afa28ae64c501576692171 || 6e8f4abf584253cbaa596ea4ad13110cf61cd4c9 || 8e33102309bd6839b2e2e158f93a7b378cb4655d || >=5.15.62 <5.16 || >=5.18.18 <5.19 || >=5.19.2 <5.20 | a2051ffe452afad52f580b85a3fd8851933b1e7c, a29f57a14c939586d84d7fd6a029bd1fd170098f, a4a307d149327dad5fb25187e1b03cebd1b04de6, 8e4f75e979c1d9a51b0a48ac33d0cfd5f039ec67, 79decd88dd3f0d42e7fb0689b1a7853bfa302459, 5.16, 5.19, 5.20 |
| Linux/Linuxgeneric | 6.0 | Not reported |
| Linux/Linuxgeneric | >=8f0541186e9ad1b62accc9519cc2b7a7240272a7 <930dcdd888eabf166589e020dcbf6d15b5e13305 || >=8f0541186e9ad1b62accc9519cc2b7a7240272a7 <a2051ffe452afad52f580b85a3fd8851933b1e7c || >=8f0541186e9ad1b62accc9519cc2b7a7240272a7 <a29f57a14c939586d84d7fd6a029bd1fd170098f || >=8f0541186e9ad1b62accc9519cc2b7a7240272a7 <a4a307d149327dad5fb25187e1b03cebd1b04de6 || >=8f0541186e9ad1b62accc9519cc2b7a7240272a7 <8e4f75e979c1d9a51b0a48ac33d0cfd5f039ec67 || >=8f0541186e9ad1b62accc9519cc2b7a7240272a7 <79decd88dd3f0d42e7fb0689b1a7853bfa302459 || cb69d4d6f709f87c94afa28ae64c501576692171 || 6e8f4abf584253cbaa596ea4ad13110cf61cd4c9 || 8e33102309bd6839b2e2e158f93a7b378cb4655d || >=5.15.62 <5.16 || >=5.18.18 <5.19 || >=5.19.2 <5.20 | 930dcdd888eabf166589e020dcbf6d15b5e13305, a2051ffe452afad52f580b85a3fd8851933b1e7c, a29f57a14c939586d84d7fd6a029bd1fd170098f, a4a307d149327dad5fb25187e1b03cebd1b04de6, 8e4f75e979c1d9a51b0a48ac33d0cfd5f039ec67, 79decd88dd3f0d42e7fb0689b1a7853bfa302459, 5.16, 5.19, 5.20 |
Published upstream
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 17, 2026
In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size smb_check_perm_dacl() validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length (acl_size) rather than the DACL's declared size (pdacl_size). When pdacl->size is smaller than the trailing NTSD buffer, bytes after the declared DACL boundary - still inside the stored security descriptor - are parsed as ACEs during access checks. A crafted DACL can place an access-granting ACE beyond pdacl->size, and the current code accepts it during SMB2_CREATE access validation, while parse_dacl() and smb_inherit_dacl() stop at pdacl_size. Bound both ACE walks by pdacl_size to match the DACL boundary semantics used elsewhere in the server. Validation: - semantic KUnit harness shows the post-boundary ACE is selected before the fix and rejected (EACCES) after it - linux master (7.2-rc6), x86_64
Quoted source text, attributed separately from HOL analysis.