In the Linux kernel, the following vulnerability has been resolved:
smb: client: require a full NFS mode SID before reading mode bits
parse_dacl() treats an ACE SID matching sid_unix_NFS_mode as an NFS
mode SID and reads sid.sub_auth[2] to recover the mode bits.
That assumes the ACE carries three subauthorities, but compare_sids()
only compares min(a, b) subauthorities. A malicious server can return
an ACE with num_subauth = 2 and sub_auth[] = {88, 3}, which still
matches sid_unix_NFS_mode and then drives the sub_auth[2] read four
bytes past the end of the ACE.
Require num_subauth >= 3 before treating the ACE as an NFS mode SID.
This keeps the fix local to the special-SID mode path without changing
compare_sids() semantics for the rest of cifsacl.
References
Configurations
Configuration 1 (hide)
|
History
01 Jun 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
15 May 2026, 19:29
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Linux linux Kernel
Linux |
|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| CWE | NVD-CWE-noinfo | |
| References | () https://git.kernel.org/stable/c/2757ad3e4b6f9e0fed4c7739594e702abc5cab21 - Patch | |
| References | () https://git.kernel.org/stable/c/38a69f08ee82c450d3e4168707fff2e317dc3ff7 - Patch | |
| References | () https://git.kernel.org/stable/c/b53b8e98c23310294fc45fc686db5ee860311896 - Patch | |
| References | () https://git.kernel.org/stable/c/c8eef12af1cc73031639ea7cf16e0b10e2536b0b - Patch | |
| References | () https://git.kernel.org/stable/c/f8488c07bea2431ee12a6067d736578064fa46b4 - Patch |
11 May 2026, 08:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.6 |
08 May 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-08 14:16
Updated : 2026-06-01 17:17
NVD link : CVE-2026-43350
Mitre link : CVE-2026-43350
CVE.ORG link : CVE-2026-43350
JSON object : View
Products Affected
linux
- linux_kernel
CWE