PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-53390 Linux CVE debrief

A Linux kernel vulnerability, CVE-2026-53390, was resolved to address an out-of-bounds read in the smb_check_perm_dacl() function. This vulnerability arises from the function failing to verify if the size of an Access Control Entry (ACE) is sufficient to contain a certain number of sub-authorities before accessing them. An attacker could exploit this by crafting a malicious ACE that, when processed, leads to a heap out-of-bounds read. This vulnerability can be triggered through a network request, specifically via SMB2_CREATE, by an authenticated client on a share that utilizes ACL xattrs.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-19
Original CVE updated
2026-07-19
Advisory published
2026-07-19
Advisory updated
2026-07-19

Who should care

System administrators and security professionals managing Linux kernel-based systems, especially those utilizing SMB shares with ACL xattrs, should be aware of this vulnerability. Ensuring that systems are updated with the latest kernel patches is crucial to mitigate the risk associated with this vulnerability.

Technical summary

The vulnerability is located in the smb_check_perm_dacl() function of the Linux kernel's ksmbd module. The function improperly checks the size of an ACE (Access Control Entry) before accessing its sub-authorities, leading to a potential out-of-bounds read. This issue can be exploited remotely by an authenticated attacker through SMB2_CREATE requests on shares using ACL xattrs. The exploit involves crafting a malicious ACE that triggers the out-of-bounds read when processed.

Defensive priority

High

Recommended defensive actions

  • Apply the latest Linux kernel updates to ensure the smb_check_perm_dacl() function is patched.
  • Restrict access to SMB shares using ACL xattrs to trusted users and networks.
  • Monitor SMB2_CREATE requests for suspicious activity.
  • Implement additional security measures such as intrusion detection systems to alert on potential exploitation attempts.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and associated details were obtained from official sources including CVE.org and the National Vulnerability Database (NVD). The vulnerability was resolved through patches applied to the Linux kernel, addressing the out-of-bounds read issue in the smb_check_perm_dacl() function.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-19T12:16:50.000Z and has not been modified since then.