CVE-2026-43350

Vulnerability

Details

The vulnerability resides in the Linux kernel's CIFS/SMB client, specifically in the parse_dacl() function. When processing an Access Control Entry (ACE), if its Security Identifier (SID) matches sid_unix_NFS_mode, the function reads sid.sub_auth[2] to extract mode bits. However, compare_sids() only compares the minimum number of subauthorities, so a crafted ACE with only two subauthorities (e.g., {88,3}) still matches, and then accessing sub_auth[2] reads four bytes beyond the ACE boundary [1][2][3][4].

Exploitation

An attacker controlling a malicious SMB server can send a specially crafted ACE to a client mounting a share. The client parses the ACL during extended attribute queries (e.g., for "system.posix_acl_access"). No authentication beyond a standard SMB session is required for the server to send malicious ACL data. The client must be using the Linux kernel's CIFS client (cifs.ko) and accessing a share that triggers parsing of NFS mode SIDs.

Impact

Successful exploitation leads to an out-of-bounds read of four bytes past the ACE. This could leak kernel memory, potentially useful for bypassing KASLR or other mitigations. The vulnerability is rated High with a CVSS v3 score of 7.6, indicating significant confidentiality impact. There is no evidence of remote code execution, but information disclosure could facilitate further attacks.

Mitigation

The fix requires num_subauth >= 3 before treating an ACE as an NFS mode SID [1][2][3][4]. Users should update to a kernel version containing the commit or apply the patch. There is no workaround other than avoiding untrusted SMB servers.