CVE-2026-68098

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: bound DACL dedup walk to copied ACEs

set_ntacl_dacl() can stop copying ACEs before consuming the full input

DACL when size accounting overflows.

When that happens, num_aces reflects only the ACEs that were actually

copied into the output DACL, but set_posix_acl_entries_dacl() still

receives nt_num_aces and uses it to walk the existing ACE array during

dedup.

That makes the dedup walk scan past the copied ACE array and inspect

buffer tail that does not contain valid ACEs.

Split the two meanings currently carried by the NT ACE count. Pass the

number of copied NT ACEs to bound the dedup walk, and preserve the

original "input DACL had NT ACEs" state separately for the

Everyone/default ACL fallback.

This keeps the dedup walk aligned with the ACEs that are actually

present in the rebuilt DACL.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References