Remote Memory Corruption in Linux ksmbd Affecting Directory Creation Permissions

CVE-2026-8449

What is CVE-2026-8449?

The Linux ksmbd service is affected by a remote memory corruption vulnerability that arises during ACL inheritance. Specifically, it allows remote attackers with directory creation permissions to exploit a crafted discretionary access control list (DACL) that includes a malformed security identifier (SID) featuring an inflated num_subauth field. When exploited, this vulnerability can lead to a heap out-of-bounds read, causing unstable kernel behavior, denial of service, and may allow attackers to escalate their privileges, potentially leading to arbitrary code execution within the kernel environment.

References