Linux ksmbd EUVD-2026-86173

Requires the target host to be running the Linux kernel's ksmbd (in-kernel SMB3) server with an exported share, an attacker holding a valid authenticated SMB session (PR:L), and - critically - a parent directory configured with a restrictive default POSIX ACL / ACL_MASK whose protection ksmbd erroneously discards on child object creation. Exploitation is limited by ksmbd being a niche service (most Linux SMB deployments use userspace Samba, which is unaffected), by the requirement for authentication, and by the need for the specific ACL_MASK configuration to be present - on shares without restrictive default ACLs there is nothing to widen.

This is a real but modestly-scoped authorization flaw in the Linux kernel's ksmbd in-kernel SMB3 server. The NVD/Linux CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N = 8.1) treats it as network-reachable, low-complexity, and low-privilege with high confidentiality and integrity impact - but there is NO EPSS score, NO CISA KEV listing, and NO public POC, so all signals point to no active or imminent exploitation. The scenario is a permission-widening bug, not a memory-corruption or RCE primitive: ksmbd overwrites the VFS-computed child POSIX ACLs and mutates the parent ACL after object creation, dropping restrictive ACL_MASK entries so SMB-created objects end up with broader effective permissions than intended. Two caveats temper the raw 8.1: (1) AC:L likely understates complexity - exploitation depends on a parent directory actually carrying a restrictive default ACL / ACL_MASK, which is a specific server-side filesystem configuration, arguably AC:H; and (2) the vendor tag 'Information Disclosure' understates the issue, since the primary impact is unauthorized access/integrity via widened permissions (I:H), not passive data leakage. Overall: patch on the normal maintenance cycle, not an emergency, given the niche exposure and absence of exploitation signals.

On a server running the kernel's ksmbd SMB3 service, an authenticated SMB user creates files or directories under a share whose parent directory has a restrictive default POSIX ACL/ACL_MASK. Because ksmbd overwrites the VFS-computed child ACLs and mutates the parent ACL, the restrictive mask is lost and the new objects gain wider effective permissions than the administrator intended, allowing access that should have been denied. No public exploit code is identified at time of analysis.