All vulnerabilities
CVE-2026-98114

Linux: ksmbd: propagate DACL parsing errors

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in99ae165acf633b13df34105815110fec332a2cdcAlso 461f10a5297e85b7c1cd21838922f2e57b934d2d, 37952f03d5171eb3a33b2abc2cf6e456d69ff4a1CVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 99ae165acf633b13df34105815110fec332a2cdcLinuxCVE List
  • 461f10a5297e85b7c1cd21838922f2e57b934d2dLinuxCVE List
  • 37952f03d5171eb3a33b2abc2cf6e456d69ff4a1LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: propagate DACL parsing errors

parse_dacl() silently accepts truncated ACEs and allocation failures, allowing set_info_sec() to continue with an incomplete ACL conversion.

Return parsing and allocation errors to parse_sec_desc() so malformed security descriptors are rejected before inode attributes or ACL xattrs are updated.

Text from CVE List

Affected versions 12

  • Linuxaffected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before 99ae165acf633b13df34105815110fec332a2cdcCVE List
  • Linuxaffected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before 461f10a5297e85b7c1cd21838922f2e57b934d2dCVE List
  • Linuxaffected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before 37952f03d5171eb3a33b2abc2cf6e456d69ff4a1CVE List
  • Linuxaffected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before a04dac1f2cffe9533f4260f0659297d805e69194CVE List
  • Linuxaffected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before c61dc7b1b4a3234b4aa3965502908a292238805cCVE List
  • Linuxaffected: 5.15CVE List
  • Linuxunaffected: all versions before 5.15CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5