The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ksmbd: fix maximum allowed access checks The DACL permission check looks for an ACE matching the current     user and falls back to the Everyone ACE. It does not consider an Authenticated Users ACE, even though an     authenticated session is a member of that well-known group. As a result, opening a file whose access is     granted through S-1-5-11 can incorrectly fail with STATUS_ACCESS_DENIED. Treat an Authenticated Users ACE     as a fallback entry alongside Everyone. The maximal access calculation also combines access masks from     every ACE, regardless of whether its SID applies to the current user. This can grant rights belonging to     an unrelated principal. Process only ACEs applying to the user, Everyone, or Authenticated Users, and     accumulate allowed and denied masks in ACL order. Preserve explicitly requested access bits so they are     validated against the resulting maximal mask. When ACCESS_SYSTEM_SECURITY is denied, report     STATUS_PRIVILEGE_NOT_HELD instead of the generic STATUS_ACCESS_DENIED. Access to the system ACL requires a     security privilege that ksmbd does not grant. For regular files, include FILE_EXECUTE in maximal access     when the client requested GENERIC_EXECUTE and the DACL grants the complete file-read set. Keep a direct     FILE_EXECUTE request subject to the explicit DACL bit. This matches the POSIX file ACL mapping without     broadening specific execute requests. Do not replace rights from an applicable NT ACE with a POSIX ACL     entry. The POSIX ACL is only a fallback when no user, Everyone, or Authenticated Users ACE applies;
    otherwise it can incorrectly broaden the stored DACL. This fixes smb2.maximum_allowed.maximum_allowed.
    (CVE-2026-93282)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-93282

high Nessus Plugin ID 349821

Version 1.7