CVE-2026-68100

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl

set_ntacl_dacl() copies each ACE from the attacker-controlled stored

security descriptor verbatim into the response DACL without checking

sid.num_subauth. The ACE bytes (including an unchecked num_subauth)

originate from an authenticated SMB2_SET_INFO(SecInfo=DACL) that is

stored raw via ksmbd_vfs_set_sd_xattr(); parse_dacl() rejects a bad ACE

with `break` rather than an error, so parse_sec_desc() still returns

success and the malformed SD reaches the xattr intact.

On a subsequent SMB2_QUERY_INFO(SecInfo=DACL) for an inode carrying a

POSIX access ACL, build_sec_desc() -> set_ntacl_dacl() ->

set_posix_acl_entries_dacl() walks the copied ACEs and reads

ntace->sid.sub_auth[ntace->sid.num_subauth - 1]

with num_subauth taken straight from the stored SD. Since sub_auth[]

is fixed at SID_MAX_SUB_AUTHORITIES (15), a crafted num_subauth (e.g.

255) drives an

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References