Linux ksmbd ACE Parsing Out-of-Bounds Read Flaw

CVE-2026-53390 is a memory safety vulnerability in the Linux kernel's ksmbd SMB server implementation, specifically in the smb_check_perm_dacl() function that validates file permissions through Access Control Entry (ACE) parsing. The flaw occurs when the code validates an ACE header size and caps the sub-authority count but fails to verify that the ACE structure is actually large enough to contain all declared sub-authorities before dereferencing them—resulting in out-of-bounds memory reads. This affects any Linux system running ksmbd that processes SMB protocol requests with crafted ACE structures, potentially allowing remote attackers to leak kernel memory or trigger denial of service.

While this CVE currently has no mapped MITRE ATT&CK techniques, Casky's Claude-powered analysis would detect attack patterns consistent with T1040 (Traffic Capture/Exfiltration) and T1005 (Data from Local System) through memory disclosure behaviors, and T1499 (Endpoint Denial of Service) through crash patterns. Practitioners using Casky would observe security findings highlighting improper input validation in parser logic, memory boundary violations during structure traversal, and potential kernel memory leak vectors. The extended reasoning capability would correlate malformed SMB ACE structures with CVSS 8.1 impact severity, flagging this as a critical control point for SMB input sanitization and access control validation layers.