DACL Parsing Error in Linux Kernel Affects Security Management

CVE-2026-98114

What is CVE-2026-98114?

In the Linux kernel, an issue has been identified concerning the ksmbd module's handling of Discretionary Access Control Lists (DACLs). When truncation of Access Control Entries (ACEs) occurs or memory allocation failures arise, the parse_dacl() function fails to appropriately handle these errors and allows set_info_sec() to proceed with an incomplete ACL conversion. This could lead to malformed security descriptors being accepted, which might cause unintended updates to inode attributes or Access Control List (ACL) extended attributes. The vulnerability has been addressed by ensuring that parsing and allocation errors are returned to parse_sec_desc(), thereby rejecting malformed security descriptors before any critical updates take place.

References