Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: preserve VFS inherited POSIX ACL mask The VFS initializes a child's POSIX ACL from the parent's default ACL and the requested creation mode. Do not mutate the parent ACL or overwrite the child's VFS-computed access and default ACLs afterwards. This preserves restrictive ACL_MASK entries and prevents SMB object creation from widening effective permissions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-24T17:17:11.243Z",
  "pubdate": "2026-09-24T17:17:11.243Z",
  "executiveSummary": "This vulnerability involves an improper implementation of POSIX Access Control List (ACL) inheritance within the ksmbd kernel module. The issue arises from the module incorrectly overwriting the VFS-computed ACLs of newly created objects with its own processing logic.\nBy failing to respect the restrictive mask established by the parent directory's default ACLs, ksmbd inadvertently widens the effective permissions of new files or directories beyond the intended security policy.\nThis flaw represents an authorization bypass concern, as an attacker with the ability to create objects within a shared directory could potentially obtain or grant broader access than the parent's configuration dictates.\nThe vulnerability affects Linux kernel systems utilizing the ksmbd implementation. While no direct exploitation of remote code execution is described, the security implications involve unauthorized privilege escalation and the circumvention of file system access controls.\nExploitation requires the ability to create objects on an exposed SMB share managed by a vulnerable version of ksmbd. Successful exploitation results in the creation of objects with overly permissive ACLs, potentially exposing sensitive data or providing unauthorized write access.",
  "technicalDetails": "The root cause of this vulnerability lies in the interaction between the ksmbd file server and the Virtual File System (VFS) layer during object creation. In Linux, when a file or directory is created within a directory containing a default POSIX ACL, the VFS layer automatically calculates the appropriate access and default ACLs for the new child object based on the parent's default ACL and the user-requested mode bits.\nIn the vulnerable implementation, ksmbd performs an explicit, incorrect overwrite of these VFS-computed ACLs. Specifically, it fails to preserve the ACL_MASK, which is a critical component of POSIX ACLs that acts as a ceiling for permissions granted to users and groups. By mutating or overwriting the child's inherited ACLs after the VFS has initialized them, ksmbd strips away the restrictive properties intended by the administrator or the system's default policy.\nThe attack flow proceeds as follows: An authenticated user with write access to a share creates a new object (file or subdirectory). ksmbd intercepts this operation. Instead of permitting the VFS to apply the standard, secure inheritance logic, ksmbd imposes its own logic, which does not account for the calculated mask. Consequently, the resulting object is assigned an ACL that is less restrictive than the directory's default policy suggests. For example, a file that should have been restricted by an ACL_MASK might inherit broader read/write permissions than permitted by the parent's security context.\nThis behavior impacts the integrity of file system access controls on the exported share. Because the ACL_MASK is effectively ignored or incorrectly applied, permissions can be widened beyond the intended effective security posture. The vulnerable component is the file creation path within the ksmbd module. The flaw exists in the logic responsible for mapping SMB security descriptors to native Linux POSIX ACLs. Post-exploitation, an attacker can leverage these improperly created objects to bypass intended restrictions, potentially gaining read or write access to files that were supposed to be protected by parent-level ACL constraints. This does not require advanced memory corruption techniques but rather a logical misuse of the VFS inheritance API, making it a persistent configuration vulnerability that affects object creation until the patch is applied."
}