201 lines
11 KiB
JSON
201 lines
11 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-93786",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-18T17:59:28.788Z",
|
|
"datePublished": "2026-09-24T16:02:19.798Z",
|
|
"dateUpdated": "2026-10-30T12:36:40.711Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-30T12:36:40.711Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: preserve VFS inherited POSIX ACL mask\n\nThe VFS initializes a child's POSIX ACL from the parent's default ACL and\nthe requested creation mode. Do not mutate the parent ACL or overwrite the\nchild's VFS-computed access and default ACLs afterwards.\n\nThis preserves restrictive ACL_MASK entries and prevents SMB object creation\nfrom widening effective permissions."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
|
|
"baseScore": 8.1,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - SMB2 CREATE is dispatched to smb2_open() from ksmbd_conn_handler_loop() on TCP/445; after smb2_creat()/vfs_create() succeeds, smb2_open() calls ksmbd_vfs_inherit_posix_acl(), which overwrites the new object's POSIX ACL. That CREATE is the trigger; the damaged ACL then governs later SMB2 READ/WRITE.\nAC:L - ksmbd_vfs_inherit_posix_acl() does pace->e_perm=0x07 on the ACL_MASK entry of get_inode_acl(parent, ACL_TYPE_DEFAULT) then set_posix_acl()s that onto the child. A single SMB2 CREATE of a new name in a directory that already has a default POSIX ACL hits this with no race; CONFIG_FS_POSIX_ACL is the helper's own gate.\nPR:L - __handle_ksmbd_work() runs smb2_check_user_session() (SMB2_CREATE is not in the NEGOTIATE/SESSION_SETUP skip list) and smb2_get_ksmbd_tcon() before smb2_open(); that path also requires KSMBD_TREE_CONN_FLAG_WRITABLE and O_CREAT, so an authenticated share user with create rights is required, not a pre-auth client.\nUI:N - The attacking SMB client itself sends the SMB2 CREATE that makes smb2_open() call ksmbd_vfs_inherit_posix_acl() on the object it just created; no local user must mount a volume, open a file, or confirm any action.\nS:U - set_posix_acl() only replaces POSIX access/default ACL xattrs on the ksmbd-exported filesystem in this host kernel; the resulting permission widening stays in that same security authority and is not a VM escape, IOMMU bypass, or sandbox breakout.\nC:H - posix_acl_permission() grants named-user/group access as (entry.e_perm & mask.e_perm). Forcing ACL_MASK to 0x07 in ksmbd_vfs_inherit_posix_acl() drops that cap, so named principals whose default-ACL entries included ACL_READ can read new-object contents the original mask would have denied.\nI:H - The same set_posix_acl(ACL_TYPE_ACCESS) of the unmasked ACL makes ACL_WRITE in named entries effective on the new file; for directories it also writes ACL_TYPE_DEFAULT with mask 0x07, and get_inode_acl() returns the shared parent cache so the in-place e_perm store widens later inherits.\nA:N - The path stores a posix_acl_valid ACL whose ACL_MASK e_perm is 0x07 via set_posix_acl(); it does not NULL-deref, BUG, panic, hang, or leak kernel memory, so the ksmbd worker and host remain available."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/smb/server/vfs.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "f44158485826c076335d6860d35872271a83791d",
|
|
"lessThan": "8493da704275ca5ab67fb88c0ae7b71576e91951",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "f44158485826c076335d6860d35872271a83791d",
|
|
"lessThan": "4a19bb1c45667f5a5f6eff9cf6648e0f692d046f",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "f44158485826c076335d6860d35872271a83791d",
|
|
"lessThan": "591acf171644de590cda245fd8595b473a1beb70",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "f44158485826c076335d6860d35872271a83791d",
|
|
"lessThan": "0093909becbda22b62b39b654dbc607faed59cd0",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "f44158485826c076335d6860d35872271a83791d",
|
|
"lessThan": "e148e567a9252643baa125cb65d7ae9c2c6cf68a",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/smb/server/vfs.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.15",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.15",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.191",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.158",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.111",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.53",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.1.191"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.6.158"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.12.111"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.18.53"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "7.2"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/8493da704275ca5ab67fb88c0ae7b71576e91951"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/4a19bb1c45667f5a5f6eff9cf6648e0f692d046f"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/591acf171644de590cda245fd8595b473a1beb70"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/0093909becbda22b62b39b654dbc607faed59cd0"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e148e567a9252643baa125cb65d7ae9c2c6cf68a"
|
|
}
|
|
],
|
|
"title": "ksmbd: preserve VFS inherited POSIX ACL mask",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |