CVE-2026-68099

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL

check_add_overflow() unconditionally writes the truncated sum into *d

even on overflow, per its contract in include/linux/overflow.h.

The four check_add_overflow() guards in set_posix_acl_entries_dacl()

and set_ntacl_dacl() break out of the ACE-building loops on overflow,

but the truncated *size is then consumed downstream at the end of

set_ntacl_dacl():

pndacl->size = cpu_to_le16(le16_to_cpu(pndacl->size) + size);

This produces an on-wire NT ACL whose pndacl->size under-reports the

bytes actually written by the preceding fill_ace_for_sid()/memcpy()

calls, yielding a malformed ACL that can trigger out-of-bounds reads

when re-parsed by clients or ksmbd itself.

Restore *size to its pre-addition value on each overflow branch (via

`*size -= ace_sz` / `size -= nt_ace_size`) so that after the break,

*size once again holds the cumulative size of

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References