A high-severity out-of-bounds heap read vulnerability in the Linux kernel ksmbd SMB server could allow an authenticated attacker to disclose sensitive kernel memory.

This is an out-of-bounds heap read vulnerability within the ksmbd SMB server implementation, specifically occurring in the set_ntacl_dacl function. The vulnerability is triggered when an authenticated user provides a crafted security descriptor that fails to validate the sid.num_subauth field, resulting in the disclosure of approximately 1 KB of kernel memory.

The vulnerability carries a CVSS score of 8.1, indicating a high level of risk. Successful exploitation allows an authenticated attacker to read sensitive kernel memory, which may contain cryptographic keys, credentials, or other confidential system data. This poses a significant threat to data privacy and system integrity, as the exposure of such information could facilitate further unauthorized access or escalation of privileges.

Immediate Action: Update the Linux kernel to version 6.6.148, 6.12.101, 6.18.42, 7.1.6, or a later stable release provided by your distribution.

Proactive Monitoring: Monitor SMB traffic and system logs for unusual connection patterns or repeated attempts to modify security descriptors on shares.

Compensating Controls: Restrict access to the ksmbd service to trusted users only and ensure that network-level controls are in place to limit exposure of SMB services to untrusted networks.

Public Exploit Available: No

Given the potential for sensitive information disclosure, organizations utilizing the ksmbd module should prioritize applying the provided kernel patches. Administrators should verify their current kernel version and transition to the remediated versions as soon as possible to mitigate the risk of memory disclosure by authenticated users.