CVE-2026-68097

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate ACE size against SID sub-authorities

set_ntacl_dacl() validates sid.num_subauth before copying an ACE, but

does not verify that the declared ACE size contains all sub-authorities

described by that field. An undersized ACE can therefore be copied

and later make the POSIX ACL deduplication walk inspect data beyond

the copied ACE boundary.

The existing initial bound check is also too small. It only ensures

that the ACE size field is accessible before set_ntacl_dacl() reads

sid.num_subauth farther into the input buffer.

Require enough input for the fixed SID header before accessing

num_subauth, reject ACEs smaller than that header, and skip ACEs

whose declared size cannot contain the complete SID. This makes the

validation consistent with the other ACE walk paths.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References