ksmbd ShareConfig OOB

Vulnerability analysis

The ksmbd kernel server processes IPC responses from the ksmbd.mountd userspace daemon to obtain share configuration, but the original code does not properly validate the sizes of variable-length fields within these responses. When parsing veto lists, it uses unbounded string operations that can read past the allocated buffer, and when deriving the share path length, it fails to account for a separator byte, leading to an incorrect length that can cause an out-of-bounds read. The fix adds strict validation of payload sizes before any variable-length field is consumed, replaces unbounded string operations with bounded equivalents, and correctly accounts for the separator byte when computing the path length. This vulnerability is reachable from a local process that can influence or replace the ksmbd.mountd daemon, requiring no special kernel privileges beyond the ability to run or control that userspace helper.