CVE-2026-98114
In the Linux kernel, the following vulnerability has been resolved: ksmbd: propagate DACL parsing errors parse_dacl() silently accepts truncated ACEs and allocation failures, allowing set_info_sec() to continue with an incomplete ACL conversion. Return parsing and allocation errors to parse_sec_desc() so malformed security descriptors are rejected before inode attributes or ACL xattrs are updated.
- Published Sep 25, 2026
- Not yet scored
- 0.2% chance of exploitation in the next 30 days (EPSS)
- A fix is available