{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "8f0541186e9ad1b62accc9519cc2b7a7240272a7"
            },
            {
              "fixed": "a2051ffe452afad52f580b85a3fd8851933b1e7c"
            },
            {
              "fixed": "a29f57a14c939586d84d7fd6a029bd1fd170098f"
            },
            {
              "fixed": "a4a307d149327dad5fb25187e1b03cebd1b04de6"
            },
            {
              "fixed": "8e4f75e979c1d9a51b0a48ac33d0cfd5f039ec67"
            },
            {
              "fixed": "79decd88dd3f0d42e7fb0689b1a7853bfa302459"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "cb69d4d6f709f87c94afa28ae64c501576692171"
            },
            {
              "last_affected": "6e8f4abf584253cbaa596ea4ad13110cf61cd4c9"
            },
            {
              "last_affected": "8e33102309bd6839b2e2e158f93a7b378cb4655d"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "5.15.62"
            },
            {
              "fixed": "5.16"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "5.18.18"
            },
            {
              "fixed": "5.19"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "5.19.2"
            },
            {
              "fixed": "5.20"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.6.157"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.110"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.52"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90153.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: bound smb_check_perm_dacl() ACE walks by DACL size\n\nsmb_check_perm_dacl() validates that the DACL fits inside the NT\nsecurity descriptor, but then bounds its two ACE walks by the\nremaining NTSD length (acl_size) rather than the DACL's declared\nsize (pdacl_size).\n\nWhen pdacl-\u003esize is smaller than the trailing NTSD buffer, bytes\nafter the declared DACL boundary - still inside the stored security\ndescriptor - are parsed as ACEs during access checks.  A crafted\nDACL can place an access-granting ACE beyond pdacl-\u003esize, and the\ncurrent code accepts it during SMB2_CREATE access validation, while\nparse_dacl() and smb_inherit_dacl() stop at pdacl_size.\n\nBound both ACE walks by pdacl_size to match the DACL boundary\nsemantics used elsewhere in the server.\n\nValidation:\n- semantic KUnit harness shows the post-boundary ACE is selected\n  before the fix and rejected (EACCES) after it\n- linux master (7.2-rc6), x86_64",
  "id": "CVE-2026-90153",
  "modified": "2026-09-18T03:30:20.990756667Z",
  "published": "2026-09-17T16:06:46.296Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/79decd88dd3f0d42e7fb0689b1a7853bfa302459"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8e4f75e979c1d9a51b0a48ac33d0cfd5f039ec67"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a2051ffe452afad52f580b85a3fd8851933b1e7c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a29f57a14c939586d84d7fd6a029bd1fd170098f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a4a307d149327dad5fb25187e1b03cebd1b04de6"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90153.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90153"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size"
}