CVE-2026-90153: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-wffx-7972-vw67
Share
CVSS 8.1
Published
Advisory Summary

CVE-2026-90153 is a HIGH (CVSS 8.1) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-90153 at a Glance

CVE Identifier CVE-2026-90153
GHSA Identifier GHSA-wffx-7972-vw67
Severity HIGH
CVSS v3.1 Base Score 8.1
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 8.1

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability None (A:N)

How to Fix CVE-2026-90153

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-90153, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size smb_check_perm_dacl() validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length (acl_size) rather than the DACL's declared size (pdacl_size). When pdacl->size is smaller than the trailing NTSD buffer, bytes after the declared DACL boundary - still inside the stored security descriptor - are parsed as ACEs during access checks. A crafted DACL can place an access-granting ACE beyond pdacl->size, and the current code accepts it during SMB2_CREATE access validation, while parse_dacl() and smb_inherit_dacl() stop at pdacl_size. Bound both ACE walks by pdacl_size to match the DACL boundary semantics used elsewhere in the server. Validation: - semantic KUnit harness shows the post-boundary ACE is selected before the fix and rejected (EACCES) after it - linux master (7.2-rc6), x86_64

References

NVD — CVE-2026-90153 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90153
git.kernel.org/stable/c/79decd88dd... WEB
https://git.kernel.org/stable/c/79decd88dd3f0d42e7fb0689b1a7853bfa302459
git.kernel.org/stable/c/8e4f75e979... WEB
https://git.kernel.org/stable/c/8e4f75e979c1d9a51b0a48ac33d0cfd5f039ec67
git.kernel.org/stable/c/a2051ffe45... WEB
https://git.kernel.org/stable/c/a2051ffe452afad52f580b85a3fd8851933b1e7c
git.kernel.org/stable/c/a29f57a14c... WEB
https://git.kernel.org/stable/c/a29f57a14c939586d84d7fd6a029bd1fd170098f
git.kernel.org/stable/c/a4a307d149... WEB
https://git.kernel.org/stable/c/a4a307d149327dad5fb25187e1b03cebd1b04de6

Frequently Asked Questions

What is CVE-2026-90153?
CVE-2026-90153 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-90153?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-90153?
CVE-2026-90153 has a CVSS v3.1 base score of 8.1 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
What CWE is associated with CVE-2026-90153?
CVE-2026-90153 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-90153?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-wffx-7972-vw67",
  "modified" : "2026-09-18T18:31:27Z",
  "published" : "2026-09-17T18:31:52Z",
  "aliases" : [ "CVE-2026-90153" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: bound smb_check_perm_dacl() ACE walks by DACL size\n\nsmb_check_perm_dacl() validates that the DACL fits inside the NT\nsecurity descriptor, but then bounds its two ACE walks by the\nremaining NTSD length (acl_size) rather than the DACL's declared\nsize (pdacl_size).\n\nWhen pdacl->size is smaller than the trailing NTSD buffer, bytes\nafter the declared DACL boundary - still inside the stored security\ndescriptor - are parsed as ACEs during access checks.  A crafted\nDACL can place an access-granting ACE beyond pdacl->size, and the\ncurrent code accepts it during SMB2_CREATE access validation, while\nparse_dacl() and smb_inherit_dacl() stop at pdacl_size.\n\nBound both ACE walks by pdacl_size to match the DACL boundary\nsemantics used elsewhere in the server.\n\nValidation:\n- semantic KUnit harness shows the post-boundary ACE is selected\n  before the fix and rejected (EACCES) after it\n- linux master (7.2-rc6), x86_64",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-90153"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/79decd88dd3f0d42e7fb0689b1a7853bfa302459"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8e4f75e979c1d9a51b0a48ac33d0cfd5f039ec67"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a2051ffe452afad52f580b85a3fd8851933b1e7c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a29f57a14c939586d84d7fd6a029bd1fd170098f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a4a307d149327dad5fb25187e1b03cebd1b04de6"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-17T17:17:08Z"
  }
}