High 8.1Published Sep 24, 2026

CVE-2026-93786ksmbd: preserve VFS inherited POSIX ACL mask

Updated under an hour ago (Oct 26, 2026, 1:30 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ksmbd: preserve VFS inherited POSIX ACL mask The VFS initializes a child's POSIX ACL from the parent's default ACL and the requested creation mode. Do not mutate the parent ACL or overwrite the child's VFS-computed access and default ACLs afterwards. This preserves restrictive ACL_MASK entries and prevents SMB object creation from widening effective permissions.

CVSS: 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 3, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f44158485826c076335d6860d35872271a83791d before 4a19bb1c45667f5a5f6eff9cf6648e0f692d046f; from f44158485826c076335d6860d35872271a83791d before 591acf171644de590cda245fd8595b473a1beb70; from f44158485826c076335d6860d35872271a83791d before 0093909becbda22b62b39b654dbc607faed59cd0; from f44158485826c076335d6860d35872271a83791d before e148e567a9252643baa125cb65d7ae9c2c6cf68a	CNA record

References

References

https://git.kernel.org/stable/c/4a19bb1c45667f5a5f6eff9cf6648e0f692d046f
https://git.kernel.org/stable/c/591acf171644de590cda245fd8595b473a1beb70
https://git.kernel.org/stable/c/0093909becbda22b62b39b654dbc607faed59cd0
https://git.kernel.org/stable/c/e148e567a9252643baa125cb65d7ae9c2c6cf68a

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.