A flaw in the Linux kernel ksmbd implementation could allow an authenticated attacker to gain unauthorized file access by manipulating DACL boundaries.

The ksmbd component fails to properly bound ACE walks within the declared DACL size, allowing bytes following the boundary to be parsed as access control entries. This vulnerability requires an authenticated attacker to interact with the SMB server.

Successful exploitation allows an authenticated user to achieve unauthorized read or write access to files that should otherwise be protected by access control lists. Given the CVSS score of 8.1, this represents a high risk of data compromise and loss of confidentiality or integrity for sensitive file shares hosted on the Linux kernel.

Immediate Action: Update the Linux kernel to version 6.6.157, 6.12.110, 6.18.52, 7.2.6, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor SMB server logs for unusual access patterns or repeated attempts to access restricted directories by authenticated users.

Compensating Controls: Restrict access to the SMB service to trusted network segments and implement strict filesystem-level permissions that do not rely solely on the ksmbd kernel module for enforcement.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to the integrity of file shares managed by the ksmbd kernel module. System administrators should prioritize testing and deploying the provided kernel patches to their production environments immediately to prevent potential unauthorized access.