Riskcovery

CVE-2026-98114

ksmbd: propagate DACL parsing errors

State
Published
Severity
Not scored
Published
Sep 25, 2026
Updated
Oct 21, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: propagate DACL parsing errors

parse_dacl() silently accepts truncated ACEs and allocation failures, allowing set_info_sec() to continue with an incomplete ACL conversion.

Return parsing and allocation errors to parse_sec_desc() so malformed security descriptors are rejected before inode attributes or ACL xattrs are updated.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 99ae165acf633b13df34105815110fec332a2cdcAffected
  • e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 461f10a5297e85b7c1cd21838922f2e57b934d2dAffected
  • e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 37952f03d5171eb3a33b2abc2cf6e456d69ff4a1Affected
  • e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before a04dac1f2cffe9533f4260f0659297d805e69194Affected
  • e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before c61dc7b1b4a3234b4aa3965502908a292238805cAffected
LinuxLinux
  • 5.15Affected
  • before 5.15Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.111 through 6.12.*Not affected
  • 6.18.53 through 6.18.*Not affected
  • 7.2.7 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.