CVE-2026-68098

Received Received - Intake

ksmbd DACL Dedup Walk Vulnerability in Linux Kernel

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound DACL dedup walk to copied ACEs set_ntacl_dacl() can stop copying ACEs before consuming the full input DACL when size accounting overflows. When that happens, num_aces reflects only the ACEs that were actually copied into the output DACL, but set_posix_acl_entries_dacl() still receives nt_num_aces and uses it to walk the existing ACE array during dedup. That makes the dedup walk scan past the copied ACE array and inspect buffer tail that does not contain valid ACEs. Split the two meanings currently carried by the NT ACE count. Pass the number of copied NT ACEs to bound the dedup walk, and preserve the original "input DACL had NT ACEs" state separately for the Everyone/default ACL fallback. This keeps the dedup walk aligned with the ACEs that are actually present in the rebuilt DACL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68098

EUVD

EUVD-2026-55479

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	ksmbd	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel's ksmbd component involves improper handling of Access Control Entries (ACEs) in Discretionary Access Control Lists (DACLs). When copying ACEs, the system may stop prematurely due to size accounting overflow, leading to a mismatch between the number of copied ACEs and the expected count. This causes the dedup walk to scan invalid memory beyond the copied ACE array, potentially corrupting or exposing sensitive data.

Detection Guidance

This vulnerability is specific to the Linux kernel's ksmbd implementation and requires kernel-level inspection. Detection involves checking kernel logs for related errors or verifying the kernel version against patched releases. Commands like 'dmesg | grep ksmbd' or 'uname -a' may help identify affected systems.

Impact Analysis

This vulnerability could allow attackers to bypass access controls, gain unauthorized access to files or resources, or cause system instability. It may lead to data leaks, privilege escalation, or denial-of-service conditions if exploited.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data, undermining data protection measures required by GDPR and HIPAA. Organizations may face legal penalties or reputational damage if exploited.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the ksmbd DACL handling issue. If ksmbd is not actively used, consider disabling it via 'modprobe -r ksmbd' or blacklisting the module until patched.

Hi! I’m here to help you understand CVE-2026-68098. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70