CVE-2026-98114 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: propagate DACL parsing errors
parse_dacl() silently accepts truncated ACEs and allocation failures, allowing set_info_sec() to continue with an incomplete ACL conversion.
Return parsing and allocation errors to parse_sec_desc() so malformed security descriptors are rejected before inode attributes or ACL xattrs are updated.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The ksmbd component within the Linux kernel serves as a server implementation for the Server Message Block protocol, facilitating file sharing between Windows clients and Linux systems. A critical vulnerability was identified in the access control list parsing logic, specifically within the parse_dacl function which is responsible for interpreting Discretionary Access Control Lists embedded in security descriptors received from SMB clients. This flaw stems from insufficient error handling during the processing of Access Control Entries and memory allocation operations. When the parser encounters truncated ACEs or fails to allocate necessary memory structures, it previously continued execution without signaling an error condition. Consequently, this silent acceptance allowed subsequent functions like set_info_sec to proceed with incomplete or malformed ACL data, leading to potential inconsistencies in how file permissions are applied on the server side.
From a technical perspective, the core issue lies in the lack of propagation for parsing and allocation failures up the call stack. The parse_dacl function did not return error codes when it detected invalid input structures such as truncated entries or failed memory allocations. Instead, it allowed the control flow to continue, resulting in an incomplete ACL conversion process. This behavior violates fundamental principles of secure coding where partial data should never be committed if integrity checks fail. By failing to reject malformed security descriptors early in the pipeline, the kernel permitted potentially dangerous permission states to be written into inode attributes or extended attribute storage areas associated with files and directories managed by ksmbd.
The operational impact of this vulnerability is significant as it can lead to unauthorized access scenarios where clients might exploit improperly parsed ACLs to gain permissions they should not possess. An attacker could craft specific SMB requests containing malformed security descriptors that trigger the truncated ACE condition or induce allocation failures in a controlled manner. If successful, these attacks could result in privilege escalation within the context of the ksmbd service or allow unauthorized read and write access to sensitive files stored on the Linux system. This represents a serious breach of confidentiality and integrity for systems relying on ksmbd for network file sharing services.
This vulnerability aligns with CWE-20 Improper Input Validation as it involves accepting malformed input without adequate checks, and also relates to CWE-787 Out-of-bounds Write if the incomplete data leads to memory corruption during subsequent processing steps. In terms of MITRE ATT&CK framework, this flaw could be leveraged in techniques related to Privilege Escalation or Defense Evasion by manipulating access control mechanisms on shared resources. To mitigate these risks, it is essential that all parsing functions strictly validate input structures and propagate any errors encountered back to the parent function parse_sec_desc. This ensures that malformed security descriptors are rejected before they can affect inode attributes or ACL extended attributes. System administrators should apply kernel updates provided by their distribution vendors that include patches for this ksmbd issue, ensuring that proper error handling is enforced throughout the SMB protocol implementation stack.