CVE-2026-72382 Linux CVE debrief

Who should care

Linux kernel users and administrators, as well as security teams and vulnerability management teams responsible for ensuring the security and integrity of Linux kernel-based systems. These individuals should be aware of the potential risks associated with this vulnerability and take necessary steps to mitigate them. This includes verifying and applying kernel patches, restricting access to sensitive data, and monitoring system logs for suspicious activity. Additionally, operators and platform administrators should review the vulnerability details to understand the potential impact on their systems and take appropriate actions to prevent exploitation. The vulnerability management team should also review the CVE record and NVD details to assess the severity and scope of the vulnerability and prioritize remediation efforts accordingly. Security teams should consider implementing compensating controls and monitoring systems to detect potential exploitation attempts. Asset inventory and configuration management teams should ensure that accurate records of Linux kernel-based systems are maintained to facilitate remediation efforts. Change management and incident response teams should be prepared to respond to potential security incidents related to this vulnerability. Overall, a coordinated effort is required to address this vulnerability and prevent potential security breaches. Linux kernel developers and maintainers should also review the vulnerability details to ensure that the fix is properly implemented and tested. They should also consider providing additional guidance and support to users and administrators to help them understand and mitigate the vulnerability. Furthermore, Linux kernel users and administrators should be aware of the potential risks associated with using outdated or vulnerable Linux kernel versions and consider upgrading to newer versions or applying patches to address this vulnerability. By taking these steps, Linux kernel users and administrators can help prevent potential security breaches and ensure the integrity of their systems. The Linux kernel community should also review the vulnerability details to identify potential areas for future

Technical summary

The vulnerability is caused by the parse_dacl() function not properly checking the DACL size, allowing an attacker to bypass the ACE count check and drive large temporary ACL state and pointer-array allocations. A malicious client can reach this with SMB2_SET_INFO (InfoType=SMB2_O_INFO_SECURITY) -> smb2_set_info_sec() -> set_info_sec() -> parse_sec_desc() -> parse_dacl() -> init_acl_state(..., 0xffff) -> init_acl_state(..., 0xffff) -> kmalloc_objs(..., 0xffff).

Defensive priority

High

Recommended defensive actions

• Verify and apply the kernel patch
• Restrict access to sensitive data
• Monitor system logs for suspicious activity
• Verify affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by the parse_dacl() function not properly checking the DACL size. A malicious client can reach this with SMB2_SET_INFO (InfoType=SMB2_O_INFO_SECURITY) -> smb2_set_info_sec() -> set_info_sec() -> parse_sec_desc() -> parse_dacl() -> init_acl_state(..., 0xffff) -> init_acl_state(..., 0xffff) -> kmalloc_objs(..., 0xffff).

Official resources