AZL-83753
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-83753.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-83753
- Upstream
- Published
- 2026-04-24T15:16:40Z
- Modified
- 2026-08-28T17:47:57.225198032Z
- Summary
- CVE-2026-31611 affecting package kernel for versions less than 6.6.137.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: require 3 sub-authorities before reading sub_auth[2]
parsedacl() compares each ACE SID against sidunixNFSmode and on match reads sid.subauth[2] as the file mode. If sidunixNFSmode is the prefix S-1-5-88-3 with numsubauth = 2 then comparesids() compares only min(numsubauth, 2) sub-authorities so a client SID with numsubauth = 2 and sub_auth = {88, 3} will match.
If numsubauth = 2 and the ACE is placed at the very end of the security descriptor, subauth[2] will be 4 bytes past endofacl. The out-of-band bytes will then be masked to the low 9 bits and applied as the file's POSIX mode, probably not something that is good to have happen.
Fix this up by forcing the SID to actually carry a third sub-authority before reading it at all.
- References