Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-43350

smb: client: require a full NFS mode SID before reading mode bits

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.259, 5.15.210, 6.1.175, 6.6.136, 6.12.84, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

In the Linux kernel, the following vulnerability has been resolved: smb: client: require a full NFS mode SID before reading mode bits parse_dacl() treats an ACE SID matching sid_unix_NFS_mode as an NFS mode SID and reads sid.sub_auth[2] to recover the mode bits. That assumes the ACE carries three subauthorities, but compare_sids() only compares min(a, b) subauthorities. A malicious server can return an ACE with num_subauth = 2 and sub_auth[] = {88, 3}, which still matches sid_unix_NFS_mode and then drives the sub_auth[2] read four bytes past the end of the ACE. Require num_subauth >= 3 before treating the ACE as an NFS mode SID. This keeps the fix local to the special-SID mode path without changing compare_sids() semantics for the rest of cifsacl.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • Linux Linux

    From e2f8fbfb8d09c06decde162090fac3ee220aa280 · fixed in 23b54d6cc3ef30a51d984dc74364f24039ae2ecb; From e2f8fbfb8d09c06decde162090fac3ee220aa280 · fixed in 1592a6cd6f653f2d24572a6976c7a775b19f4940; From e2f8fbfb8d09c06decde162090fac3ee220aa280 · fixed in 8bd4cad3f458d11650d51c2d24b03fb1770ae6cc; From e2f8fbfb8d09c06decde162090fac3ee220aa280 · fixed in b53b8e98c23310294fc45fc686db5ee860311896; From e2f8fbfb8d09c06decde162090fac3ee220aa280 · fixed in c8eef12af1cc73031639ea7cf16e0b10e2536b0b; From e2f8fbfb8d09c06decde162090fac3ee220aa280 · fixed in 38a69f08ee82c450d3e4168707fff2e317dc3ff7; From e2f8fbfb8d09c06decde162090fac3ee220aa280 · fixed in f8488c07bea2431ee12a6067d736578064fa46b4; From e2f8fbfb8d09c06decde162090fac3ee220aa280 · fixed in 2757ad3e4b6f9e0fed4c7739594e702abc5cab21

  • Linux Linux

    5.4

  • KernelLinux

    From 5.4.0 · fixed in 5.10.259; From 5.11.0 · fixed in 5.15.210; From 5.16.0 · fixed in 6.1.175; From 6.2.0 · fixed in 6.6.136; From 6.7.0 · fixed in 6.12.84; From 6.13.0 · fixed in 6.18.25; From 6.19.0 · fixed in 7.0.2

References 8

git.kernel.org