ZDI flags CVSS 9.0 race-condition RCE in Linux KSMBD
A protocol-handler mismatch between request enqueue and dequeue can leak kernel heap memory and open an out-of-bounds write path.
By oops#ksmbd
ksmbd ACL packing fixed to block malformed DACLs and OOB reads
Authenticated clients could force undersized ACL headers or heap out-of-bounds reads via crafted security descriptors.
By oops