Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-53390

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds read in smb_check_perm_dacl() The permission-check ACE walk in smb_check_perm_dacl() validates the ACE header size and caps sid.num_subauth at SID_MAX_SUB_AUTHORITIES, but it never checks that ace->size is actually large enough to contain num_subauth sub-authorities before compare_sids() dereferences them. CIFS_SID_BASE_SIZE covers the SID header up to but excluding the sub_auth[] array, and offsetof(
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:bedae52997976ab910ba0eb51216e15c6490d5f1a2f9fb0ed7b394a46002b581
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c7488c85fd822959e9b5c22fbd9e7c8a21caf5e0","status":"affected","version":"282cbbb476b9f35793452bc461934af4c7eca169","versionType":"git"},{"lessThan":"988c93d3bba066d8669143e6ec30bb2be9608d53","status":"affected","version":"f20adc4ef7428bc485ee83fd1a592252fb87718b","versionType":"git"},{"lessThan":"36599894fa8536fefdf1e296c0af71b8b7226859","status":"affected","version":"325d4ac11f526cb8964cff1…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:2e46fa1e0bc4df3ea2adaf11d56e91cca9f789d870f514f85517988c4340dd21 · sha256:0fad20e98c1eba4d… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.1"},{"lessThan":"7.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.177","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.144","versionType":"semver"},{"lessThanOr…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:2e46fa1e0bc4df3ea2adaf11d56e91cca9f789d870f514f85517988c4340dd21 · sha256:0fad20e98c1eba4d… · /containers/cna/affected/1

Affected products and versions

2 source assertions
{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c7488c85fd822959e9b5c22fbd9e7c8a21caf5e0","status":"affected","version":"282cbbb476b9f35793452bc461934af4c7eca169","versionType":"git"},{"lessThan":"988c93d3bba066d8669143e6ec30bb2be9608d53","status":"affected","version":"f20adc4ef7428bc485ee83fd1a592252fb87718b","versionType":"git"},{"lessThan":"36599894fa8536fefdf1e296c0af71b8b7226859","status":"affected","version":"325d4ac11f526cb8964cff1…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:2e46fa1e0bc4df3ea2adaf11d56e91cca9f789d870f514f85517988c4340dd21 · sha256:0fad20e98c1eba4d… · /containers/cna/affected/0
{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.1"},{"lessThan":"7.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.177","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.144","versionType":"semver"},{"lessThanOr…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:2e46fa1e0bc4df3ea2adaf11d56e91cca9f789d870f514f85517988c4340dd21 · sha256:0fad20e98c1eba4d… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:2e46fa1e0bc4df3ea2adaf11d56e91cca9f789d870f514f85517988c4340dd21 · sha256:0fad20e98c1eba4d… · /containers/cna/metrics/0/cvssV3_1

Source references

7 source assertions
{"url":"https://git.kernel.org/stable/c/1ef06004ed4bd6d3ed8c840d9d1a376b66d4935b"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2e46fa1e0bc4df3ea2adaf11d56e91cca9f789d870f514f85517988c4340dd21 · sha256:0fad20e98c1eba4d… · /containers/cna/references/6
{"url":"https://git.kernel.org/stable/c/36599894fa8536fefdf1e296c0af71b8b7226859"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2e46fa1e0bc4df3ea2adaf11d56e91cca9f789d870f514f85517988c4340dd21 · sha256:0fad20e98c1eba4d… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/7627ff8c4f9919f14de562b0160ab4ec9d80b1f7"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2e46fa1e0bc4df3ea2adaf11d56e91cca9f789d870f514f85517988c4340dd21 · sha256:0fad20e98c1eba4d… · /containers/cna/references/4
{"url":"https://git.kernel.org/stable/c/988c93d3bba066d8669143e6ec30bb2be9608d53"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2e46fa1e0bc4df3ea2adaf11d56e91cca9f789d870f514f85517988c4340dd21 · sha256:0fad20e98c1eba4d… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/c7488c85fd822959e9b5c22fbd9e7c8a21caf5e0"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2e46fa1e0bc4df3ea2adaf11d56e91cca9f789d870f514f85517988c4340dd21 · sha256:0fad20e98c1eba4d… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/d5c81a095c86fe507c032d08f3a8cfc518444927"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2e46fa1e0bc4df3ea2adaf11d56e91cca9f789d870f514f85517988c4340dd21 · sha256:0fad20e98c1eba4d… · /containers/cna/references/3
{"url":"https://git.kernel.org/stable/c/e36e35660adb9b8ef1435ac359151dda5f094c55"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2e46fa1e0bc4df3ea2adaf11d56e91cca9f789d870f514f85517988c4340dd21 · sha256:0fad20e98c1eba4d… · /containers/cna/references/5

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer