CVE-2026-98114: ksmbd: propagate DACL parsing errors
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: propagate DACL parsing errors
parsedacl() silently accepts truncated ACEs and allocation failures, allowing setinfosec() to continue with an incomplete ACL conversion.
Return parsing and allocation errors to parsesecdesc() so malformed security descriptors are rejected before inode attributes or ACL xattrs are updated.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger this issue?
They need to submit a malformed SMB security descriptor containing truncated access control entries, or trigger an allocation failure while the descriptor’s discretionary ACL is being parsed. The vulnerable path is reached when ksmbd processes security information through set_info_sec().
What can indicate that a system may have been affected?
On an affected kernel, malformed security descriptors may have been accepted and processing may have continued with an incomplete ACL conversion. This can result in inode attributes or ACL extended attributes being updated despite DACL parsing or allocation errors.
What is the security-relevant behavior after the fix?
DACL parsing and allocation errors are propagated to parse_sec_desc(). Malformed security descriptors are rejected before inode attributes or ACL xattrs are modified.