CVE-2026-68097
Received Received - Intake

ksmbd ACE Size Validation Flaw in Linux Kernel

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ACE size against SID sub-authorities set_ntacl_dacl() validates sid.num_subauth before copying an ACE, but does not verify that the declared ACE size contains all sub-authorities described by that field. An undersized ACE can therefore be copied and later make the POSIX ACL deduplication walk inspect data beyond the copied ACE boundary. The existing initial bound check is also too small. It only ensures that the ACE size field is accessible before set_ntacl_dacl() reads sid.num_subauth farther into the input buffer. Require enough input for the fixed SID header before accessing num_subauth, reject ACEs smaller than that header, and skip ACEs whose declared size cannot contain the complete SID. This makes the validation consistent with the other ACE walk paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68097
EUVD
EUVD-2026-55478

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel to 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper validation of Access Control Entry (ACE) sizes in the ksmbd module. The issue occurs when set_ntacl_dacl() checks the number of sub-authorities in a Security Identifier (SID) but fails to ensure the ACE size can accommodate all sub-authorities. This allows copying an undersized ACE, which can lead to reading data beyond the ACE boundary during POSIX ACL deduplication.

Detection Guidance

This vulnerability is specific to the Linux kernel's ksmbd implementation and requires kernel-level inspection. Detection involves checking kernel logs for related errors or verifying if your kernel version includes the fix. Commands like 'dmesg | grep ksmbd' or 'uname -a' may help identify affected systems.

Impact Analysis

This vulnerability could allow an attacker to cause memory corruption or information disclosure by exploiting the undersized ACE to access unauthorized data. It may lead to system instability, crashes, or privilege escalation if exploited.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for CVE-2026-68097. Monitor vendor advisories for kernel updates and apply them promptly. Disable ksmbd if not in use until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68097. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart