CVE-2026-93282

A flaw was found in the Linux kernel's ksmbd server. This flaw allows an authenticated remote user to bypass access controls and gain unauthorized file access. When calculating maximal access permissions, ksmbd improperly combines rights from every Access Control Entry (ACE) regardless of whether the entry applies to the requesting user. Consequently, an attacker can obtain access privileges belonging to unrelated accounts on the shared filesystem.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.