CVE-2026-68099ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL check_add_overflow() unconditionally writes the truncated sum into *d even on overflow, per its contract in include/linux/overflow.h. The four check_add_overflow() guards in set_posix_acl_entries_dacl() and set_ntacl_dacl() break out of the ACE-building loops on overflow, but the truncated *size is then consumed downstream at the end of set_ntacl_dacl(): pndacl->size = cpu_to_le16(le16_to_cpu(pndacl->size) + size); This produces an on-wire NT ACL whose pndacl->size under-reports the bytes actually written by the preceding fill_ace_for_sid()/memcpy() calls, yielding a malformed ACL that can trigger out-of-bounds reads when re-parsed by clients or ksmbd itself. Restore *size to its pre-addition value on each overflow branch (via `*size -= ace_sz` / `size -= nt_ace_size`) so that after the break, *size once again holds the cumulative size of the successfully-written ACEs. The committed ACL is then truncated-but-self-consistent rather than malformed. The ksmbd DACL builders are the only check_add_overflow() sites found where an overflow path breaks out of a loop and the destination value is consumed afterward. The other nearby break-style cases either return -EINVAL on overflow (transport_ipc.c) or break without consuming the overflowed destination value afterward (buildid.c).
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 23, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 41e53a773db6342ac9a689ee5ba635c31744c9f0 builds before 8f3a7a499a7d9bb1c0f33fe78c4a4594d7e307f4; from 8d5729350b236896f51379588d9a690b7fafb8db before f4fcd0c1a243d449307b887fafee23921e9db5ab; from e1955a94b6f17f4b058afa955a6f187eb3ed7615 before 0bf38372821b1526f31538a7d9811844c55c7f38; from 5e7b8f3c539d69b2ed5f2408e2f75e68ce7eef43 before 847ecd4eb3c117c3d2f13f1e7ab506543aad8183; from 299f962c0b02d048fb45d248b4da493d03f3175d before bc90144ce8bb7fcf05ad9417c7adb4e9509d9e13; from 299f962c0b02d048fb45d248b4da493d03f3175d before bbf0a8e931204ecdab494a88d43b0a24a04285c5; ef7902be3f215b6bf7babe4dc9dd9a7d57dad7a7; from 6.1.175 before 6.1.184; and 4 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/8f3a7a499a7d9bb1c0f33fe78c4a4594d7e307f4
- https://git.kernel.org/stable/c/f4fcd0c1a243d449307b887fafee23921e9db5ab
- https://git.kernel.org/stable/c/0bf38372821b1526f31538a7d9811844c55c7f38
- https://git.kernel.org/stable/c/847ecd4eb3c117c3d2f13f1e7ab506543aad8183
- https://git.kernel.org/stable/c/bc90144ce8bb7fcf05ad9417c7adb4e9509d9e13
- https://git.kernel.org/stable/c/bbf0a8e931204ecdab494a88d43b0a24a04285c5
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.