Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix maximum allowed access checks The DACL permission check looks for an ACE matching the current user and falls back to the Everyone ACE. It does not consider an Authenticated Users ACE, even though an authenticated session is a member of that well-known group. As a result, opening a file whose access is granted through S-1-5-11 can incorrectly fail with STATUS_ACCESS_DENIED. Treat an Authenticated Users ACE as a fallback entry alongside Everyone. The maximal access calculation also combines access masks from every ACE, regardless of whether its SID applies to the current user. This can grant rights belonging to an unrelated principal. Process only ACEs applying to the user, Everyone, or Authenticated Users, and accumulate allowed and denied masks in ACL order. Preserve explicitly requested access bits so they are validated against the resulting maximal mask. When ACCESS_SYSTEM_SECURITY is denied, report STATUS_PRIVILEGE_NOT_HELD instead of the generic STATUS_ACCESS_DENIED. Access to the system ACL requires a security privilege that ksmbd does not grant. For regular files, include FILE_EXECUTE in maximal access when the client requested GENERIC_EXECUTE and the DACL grants the complete file-read set. Keep a direct FILE_EXECUTE request subject to the explicit DACL bit. This matches the POSIX file ACL mapping without broadening specific execute requests. Do not replace rights from an applicable NT ACE with a POSIX ACL entry. The POSIX ACL is only a fallback when no user, Everyone, or Authenticated Users ACE applies; otherwise it can incorrectly broaden the stored DACL. This fixes smb2.maximum_allowed.maximum_allowed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-24T16:17:25.570Z",
  "pubdate": "2026-09-24T16:17:25.570Z",
  "executiveSummary": "The vulnerability in ksmbd involves flaws in the processing of Discretionary Access Control Lists (DACLs) and Access Control Entries (ACEs) during maximum allowed access checks.\nThe primary issue is an improper implementation of access logic that fails to correctly evaluate 'Authenticated Users' (S-1-5-11) SIDs and incorrectly aggregates access masks from irrelevant principals.\nThis vulnerability can result in both unauthorized access denial (denial of service for legitimate users) and potential privilege escalation by improperly aggregating permissions.\nThe flaw exists within the ksmbd kernel module, which handles SMB3 protocol processing within the Linux kernel.\nAn attacker with access to an authenticated session can exploit these inconsistencies to bypass intended file-level security constraints or disrupt access to shared resources.\nThis issue represents a failure in security policy enforcement, where the effective permissions of a user are miscalculated based on the provided ACL structure.",
  "technicalDetails": "The root cause of the vulnerability lies in the ksmbd DACL evaluation logic, which failed to incorporate the 'Authenticated Users' (S-1-5-11) security identifier (SID) as a valid fallback, instead relying solely on the 'Everyone' SID. This caused legitimate access requests by authenticated users to be incorrectly rejected with STATUS_ACCESS_DENIED.\nFurthermore, the maximal access calculation logic was fundamentally flawed in its aggregation process. Instead of filtering ACEs applicable to the current security context, the implementation aggregated access masks from every entry within the ACL. This meant that permissions belonging to unrelated principals were incorrectly combined, potentially leading to a situation where a user could exercise privileges they were not explicitly granted.\nThe system also mismanaged specific security bits; notably, it failed to return the correct error code (STATUS_PRIVILEGE_NOT_HELD) when ACCESS_SYSTEM_SECURITY was requested, instead defaulting to a generic access denied status, which masks the underlying lack of administrative privilege.\nThe vulnerability is further compounded by a logic error regarding the interaction between POSIX ACLs and NT ACLs. The kernel improperly replaced NT ACE rights with POSIX fallback entries even when explicit user, Everyone, or Authenticated Users ACEs were present, leading to an insecure broadening of stored DACLs beyond the administrator's original configuration.\nExploitation flow typically occurs during an SMB2/3 session. An attacker identifies a file share where access is controlled via S-1-5-11 or contains complex ACL structures. By sending an SMB2_CREATE request with a 'maximum allowed' access request, the attacker triggers the faulty kernel code path. The kernel's miscalculation of the maximal access mask allows the attacker to either experience an unexpected denial of service or, conversely, gain access to resources that should have been restricted to other principals. When the system incorrectly accumulates access bits, it effectively returns a security descriptor that grants the attacker elevated rights, allowing them to perform unauthorized file system operations."
}