CVE-2026-93786 ksmbd: preserve VFS inherited POSIX ACL mask

High 8.1 Published 24 Sep 2026 Updated 3 Oct 2026

An attacker can widen effective permissions on SMB objects by exploiting incorrect POSIX ACL mask handling in the Linux kernel ksmbd module.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-93786?

CVE-2026-93786 is a high-severity vulnerability in Linux, published on 24 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: preserve VFS inherited POSIX ACL mask

The VFS initializes a child's POSIX ACL from the parent's default ACL and the requested creation mode. Do not mutate the parent ACL or overwrite the child's VFS-computed access and default ACLs afterwards.

This preserves restrictive ACL_MASK entries and prevents SMB object creation from widening effective permissions.

Which versions are affected by CVE-2026-93786?

How do I fix CVE-2026-93786?

Apply the vendor's patch.

Is CVE-2026-93786 being exploited?

There is no known exploitation of CVE-2026-93786 in the wild and no public exploit code.

Sources

Also known as AZL-103878, BELL-CVE-2026-93786, DEBIAN-CVE-2026-93786, GHSA-h69q-mp6v-qjfh, UBUNTU-CVE-2026-93786.