ksmbd: fix slab out of bounds write in smb_inherit_dacl()
No sign of exploitation. No public exploitation artifact known so far.
A memory overflow vulnerability in the Linux kernel's ksmbd SMB server allows writing data beyond allocated memory boundaries in the smb_inherit_dacl() function. This can be exploited by an attacker to corrupt memory and potentially crash the system or execute arbitrary code.
The vulnerability occurs when offset values in SMB ACL inheritance operations exceed the allocated buffer size for the parent security descriptor (pntsd), resulting in out-of-bounds writes. The flaw affects ksmbd's smb_inherit_dacl() function; an authenticated SMB client can trigger this by sending specially crafted requests with malformed ACL data. Exploitation requires network access to the ksmbd service and valid SMB authentication credentials.