Linux Kernel ksmbd EUVD-2026-86154

Requires the target Linux host to have the in-kernel ksmbd SMB3 server configured and running with an exported share, plus a valid authenticated SMB session (PR:L). The over-grant is only realized when the accessed file's DACL contains ACEs for principals other than the caller (or Everyone/Authenticated Users), and when the client issues a MAXIMUM_ALLOWED access request whose maximal-mask computation folds in those unrelated ACE masks. Limiting factors: ksmbd is not the default Linux SMB stack (Samba is far more common), authentication is required, and files with only caller-specific ACEs are unaffected.

This is a genuine but conditional authorization flaw in the Linux kernel's in-kernel SMB3 server (ksmbd), rated CVSS 3.1 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The core security defect is that the maximal-access calculation accumulated access masks from every ACE in a file's DACL regardless of whether the ACE's SID actually applied to the requesting user, so an authenticated SMB user requesting MAXIMUM_ALLOWED could receive read/write rights belonging to an unrelated principal - hence both C:H and I:H. The network vector and low complexity are realistic once the precondition (an authenticated SMB session, PR:L) is met, so this is a real access-control weakness rather than a paper-high score. However, mitigating real-world risk: it only affects hosts actually running ksmbd (most Linux SMB serving uses userspace Samba), and it requires files whose DACLs contain ACEs for principals other than the caller. No EPSS score, KEV listing, or public exploit is provided in the input, indicating no evidence of active or imminent exploitation. The CWE is listed as N/A but the behavior is clearly improper authorization (CWE-863/284); the sole 'Information Disclosure' tag understates the integrity (I:H) impact since the flaw also over-grants write access.

An attacker with valid credentials to an SMB share exported by a Linux host running ksmbd opens a file using a MAXIMUM_ALLOWED access request. Because ksmbd merged permission bits from ACEs belonging to other users/groups into the caller's granted mask, the attacker obtains read and write rights that the DACL never intended for their principal, allowing unauthorized reading or modification of the file. No public exploit code is identified in the provided data.