CVE-2026-68099
Received Received - Intake

ksmbd ACL Size Corruption Leading to Malformed ACL

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL check_add_overflow() unconditionally writes the truncated sum into *d even on overflow, per its contract in include/linux/overflow.h. The four check_add_overflow() guards in set_posix_acl_entries_dacl() and set_ntacl_dacl() break out of the ACE-building loops on overflow, but the truncated *size is then consumed downstream at the end of set_ntacl_dacl(): pndacl->size = cpu_to_le16(le16_to_cpu(pndacl->size) + size); This produces an on-wire NT ACL whose pndacl->size under-reports the bytes actually written by the preceding fill_ace_for_sid()/memcpy() calls, yielding a malformed ACL that can trigger out-of-bounds reads when re-parsed by clients or ksmbd itself. Restore *size to its pre-addition value on each overflow branch (via `*size -= ace_sz` / `size -= nt_ace_size`) so that after the break, *size once again holds the cumulative size of the successfully-written ACEs. The committed ACL is then truncated-but-self-consistent rather than malformed. The ksmbd DACL builders are the only check_add_overflow() sites found where an overflow path breaks out of a loop and the destination value is consumed afterward. The other nearby break-style cases either return -EINVAL on overflow (transport_ipc.c) or break without consuming the overflowed destination value afterward (buildid.c).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68099
EUVD
EUVD-2026-55480

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel ksmbd *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the ksmbd component in the Linux kernel. It involves a flaw in how DACL (Discretionary Access Control List) sizes are handled during ACL (Access Control List) operations. The check_add_overflow() function writes a truncated sum into a size variable even when an overflow occurs. This leads to a malformed ACL that under-reports the actual bytes written, causing potential out-of-bounds reads when the ACL is re-parsed.

Detection Guidance

This vulnerability affects the ksmbd module in the Linux kernel and may lead to malformed ACLs. Detection requires checking kernel logs for ksmbd-related errors or inspecting ACL structures for inconsistencies. Commands like dmesg | grep ksmbd or journalctl -u ksmbd may help identify issues.

Impact Analysis

This vulnerability could allow attackers to trigger out-of-bounds memory reads by sending malformed ACLs. This might lead to crashes, data leaks, or privilege escalation in systems using ksmbd for SMB file sharing. Systems relying on ksmbd for network file access are particularly at risk.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Disable ksmbd if not in use. Monitor for malformed ACLs in logs. Ensure all systems using ksmbd are updated to a patched version.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68099. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart