An incorrect ACL inheritance logic in the ksmbd module allowed child objects created over SMB to inherit overly permissive access control lists. The VFS would combine the parent’s default ACL with the requested creation mode, but older kernel versions could modify the parent ACL or overwrite the child’s ACL entries, effectively widening the child’s effective permissions. This flaw permits an SMB client with write access to a directory to create files or directories that the client should not be able to modify, leading to privilege escalation within the host.

All Linux kernel releases that include the ksmbd SMB server and have not applied the ACL mask preservation patch (the fix was introduced in commits linked in the advisory). This affects any distribution kernel where ksmbd is compiled and active.

The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and its EPSS score is < 1% (0.0033). Based on the description, it is inferred that the flaw resides in a kernel module that processes SMB network traffic, which implies it can be exploited over the network by a malicious SMB client. No public exploit code is known, but the absence of a public listing does not preclude exploitation. The CVSS score of 8.1 indicates a high severity, and the potential impact is privilege escalation for authenticated SMB users.