CVE-2026-93786 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: preserve VFS inherited POSIX ACL mask
The VFS initializes a child's POSIX ACL from the parent's default ACL and the requested creation mode. Do not mutate the parent ACL or overwrite the child's VFS-computed access and default ACLs afterwards.
This preserves restrictive ACL_MASK entries and prevents SMB object creation from widening effective permissions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The ksmbd kernel module, which provides Server Message Block protocol support for Linux systems, contained a logic flaw in its handling of POSIX Access Control Lists during file and directory creation operations. When the Virtual File System layer creates new objects such as files or directories, it calculates the resulting permissions by combining the parent directory's default ACL with the mode bits requested by the application creating the object. This process is designed to ensure that inherited access control entries are applied correctly while respecting any restrictive masks defined in the parent's default ACL structure. However, a defect in the ksmbd implementation caused it to improperly mutate these calculated permissions after they were initially set by the VFS layer. Specifically, the code failed to preserve the integrity of the POSIX ACL mask entry that should have been inherited from the parent directory's default ACL settings.
This technical flaw results in an incorrect application of access control rules where the effective permissions for newly created SMB objects are widened beyond what was intended by the system administrator or defined by the inheritance policy. By overwriting the VFS-computed access and default ACLs, ksmbd effectively ignored restrictive mask entries that were meant to limit user privileges. This behavior contradicts standard POSIX ACL semantics which dictate that inherited masks should constrain the maximum permissions granted to users based on their group memberships or named user entries. The failure to preserve these restrictions means that a client connecting via SMB could potentially gain higher levels of access than authorized, bypassing security controls designed to enforce least-privilege principles within shared directories.
From an operational impact perspective, this vulnerability allows for privilege escalation in the context of file system permissions on systems running affected versions of the Linux kernel with ksmbd enabled. An attacker or malicious user who has write access to a directory with restrictive default ACLs could create new files or subdirectories that possess broader read, write, or execute permissions than intended. This can lead to unauthorized data exposure if sensitive files are created in shared locations where they should have been restricted, or it could allow for the creation of executable scripts with elevated privileges depending on how other services interact with these newly created objects. The vulnerability essentially undermines the integrity of mandatory access controls implemented through POSIX ACLs over SMB shares, creating a discrepancy between configured security policies and actual enforced permissions.
The issue is categorized under CWE-276 which refers to Incorrect Default Permissions, as it involves the improper setting of default or inherited permission values that lead to unintended accessibility. In terms of attack patterns, this align with ATT&CK technique T1059 Command and Scripting Interpreter if an attacker leverages these widened permissions to execute unauthorized scripts, or more broadly under privilege escalation vectors where file system controls are bypassed. To mitigate this risk, administrators must ensure that the Linux kernel is updated to a version containing the fix for ksmbd ACL handling. Additionally, organizations should audit their SMB share configurations and verify that POSIX ACLs are correctly applied by testing object creation in controlled environments with restrictive default masks. Regular monitoring of file system permissions on shared directories can also help detect any anomalies resulting from this vulnerability before it is patched.