CVE-2026-98114
Received Received - Intake

ksmbd DACL Parsing Error Handling Flaw

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: propagate DACL parsing errors parse_dacl() silently accepts truncated ACEs and allocation failures, allowing set_info_sec() to continue with an incomplete ACL conversion. Return parsing and allocation errors to parse_sec_desc() so malformed security descriptors are rejected before inode attributes or ACL xattrs are updated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98114
EUVD
EUVD-2026-86945

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of DACL (Discretionary Access Control List) parsing in the ksmbd component. The parse_dacl() function incorrectly accepts truncated ACEs (Access Control Entries) and allocation failures, leading to incomplete ACL (Access Control List) conversion. This allows set_info_sec() to proceed with an invalid ACL, potentially causing security issues.

Impact Analysis

This vulnerability could allow attackers to manipulate file permissions or access controls on a system running the affected Linux kernel. By exploiting this, they might gain unauthorized access to files or directories, escalate privileges, or bypass security restrictions.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the ksmbd DACL parsing error. Monitor vendor advisories for kernel updates addressing this issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98114. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart