CVE-2026-93786: ksmbd: preserve VFS inherited POSIX ACL mask
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: preserve VFS inherited POSIX ACL mask
The VFS initializes a child's POSIX ACL from the parent's default ACL and the requested creation mode. Do not mutate the parent ACL or overwrite the child's VFS-computed access and default ACLs afterwards.
This preserves restrictive ACLMASK entries and prevents SMB object creation from widening effective permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.158 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.111 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.53 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Ensure ksmbd does not mutate the parent ACL or overwrite the child's VFS-computed access and default ACLs after inheritance; preserve restrictive ACL_MASK entries.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's ksmbd SMB server are exposed when SMB clients can create objects in directories that use inherited POSIX default ACLs, particularly where restrictive ACL_MASK entries are expected to limit effective permissions.
What must an attacker be able to do to exploit it?
An attacker needs the ability to create SMB objects through ksmbd in a directory with a default POSIX ACL. The issue can cause created objects to receive broader effective permissions than the VFS-computed inherited ACL and requested creation mode should allow.
How can I determine whether this may have affected existing objects?
Review files and directories created through ksmbd beneath directories with default POSIX ACLs, and compare their effective ACL permissions and ACL_MASK entries with the parent directory's intended inherited restrictions. Objects whose permissions are wider than those restrictions may warrant remediation.
What can be done if the update cannot be applied immediately?
Limit untrusted users' ability to create objects through ksmbd in directories that rely on restrictive default POSIX ACLs. Review and correct ACLs on SMB-created objects, especially in locations where ACL_MASK restrictions are used.