All vulnerabilities
CVE-2026-93786

Linux: ksmbd: preserve VFS inherited POSIX ACL mask

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
8.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 26% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4a19bb1c45667f5a5f6eff9cf6648e0f692d046fAlso 591acf171644de590cda245fd8595b473a1beb70, 0093909becbda22b62b39b654dbc607faed59cd0CVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 4a19bb1c45667f5a5f6eff9cf6648e0f692d046fLinuxCVE List
  • 591acf171644de590cda245fd8595b473a1beb70LinuxCVE List
  • 0093909becbda22b62b39b654dbc607faed59cd0LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: preserve VFS inherited POSIX ACL mask

The VFS initializes a child's POSIX ACL from the parent's default ACL and the requested creation mode. Do not mutate the parent ACL or overwrite the child's VFS-computed access and default ACLs afterwards.

This preserves restrictive ACL_MASK entries and prevents SMB object creation from widening effective permissions.

Text from CVE List

Affected versions 10

  • Linuxaffected: f44158485826c076335d6860d35872271a83791d before 4a19bb1c45667f5a5f6eff9cf6648e0f692d046fCVE List
  • Linuxaffected: f44158485826c076335d6860d35872271a83791d before 591acf171644de590cda245fd8595b473a1beb70CVE List
  • Linuxaffected: f44158485826c076335d6860d35872271a83791d before 0093909becbda22b62b39b654dbc607faed59cd0CVE List
  • Linuxaffected: f44158485826c076335d6860d35872271a83791d before e148e567a9252643baa125cb65d7ae9c2c6cf68aCVE List
  • Linuxaffected: 5.15CVE List
  • Linuxunaffected: all versions before 5.15CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 4