CVE-2026-68099 (GCVE-0-2026-68099)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:58 – Updated: 2026-08-23 12:45
VLAI
Title
ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL check_add_overflow() unconditionally writes the truncated sum into *d even on overflow, per its contract in include/linux/overflow.h. The four check_add_overflow() guards in set_posix_acl_entries_dacl() and set_ntacl_dacl() break out of the ACE-building loops on overflow, but the truncated *size is then consumed downstream at the end of set_ntacl_dacl(): pndacl->size = cpu_to_le16(le16_to_cpu(pndacl->size) + size); This produces an on-wire NT ACL whose pndacl->size under-reports the bytes actually written by the preceding fill_ace_for_sid()/memcpy() calls, yielding a malformed ACL that can trigger out-of-bounds reads when re-parsed by clients or ksmbd itself. Restore *size to its pre-addition value on each overflow branch (via `*size -= ace_sz` / `size -= nt_ace_size`) so that after the break, *size once again holds the cumulative size of the successfully-written ACEs. The committed ACL is then truncated-but-self-consistent rather than malformed. The ksmbd DACL builders are the only check_add_overflow() sites found where an overflow path breaks out of a loop and the destination value is consumed afterward. The other nearby break-style cases either return -EINVAL on overflow (transport_ipc.c) or break without consuming the overflowed destination value afterward (buildid.c).
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 41e53a773db6342ac9a689ee5ba635c31744c9f0 , < 8f3a7a499a7d9bb1c0f33fe78c4a4594d7e307f4 (git)
Affected: 8d5729350b236896f51379588d9a690b7fafb8db , < f4fcd0c1a243d449307b887fafee23921e9db5ab (git)
Affected: e1955a94b6f17f4b058afa955a6f187eb3ed7615 , < 0bf38372821b1526f31538a7d9811844c55c7f38 (git)
Affected: 5e7b8f3c539d69b2ed5f2408e2f75e68ce7eef43 , < 847ecd4eb3c117c3d2f13f1e7ab506543aad8183 (git)
Affected: 299f962c0b02d048fb45d248b4da493d03f3175d , < bc90144ce8bb7fcf05ad9417c7adb4e9509d9e13 (git)
Affected: 299f962c0b02d048fb45d248b4da493d03f3175d , < bbf0a8e931204ecdab494a88d43b0a24a04285c5 (git)
Affected: ef7902be3f215b6bf7babe4dc9dd9a7d57dad7a7 (git)
Affected: 6.1.175 , < 6.1.184 (semver)
Affected: 6.6.136 , < 6.6.148 (semver)
Affected: 6.12.84 , < 6.12.101 (semver)
Affected: 6.18.25 , < 6.18.42 (semver)
Affected: 7.0.2 , < 7.1 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 6.1.184 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smbacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8f3a7a499a7d9bb1c0f33fe78c4a4594d7e307f4",
              "status": "affected",
              "version": "41e53a773db6342ac9a689ee5ba635c31744c9f0",
              "versionType": "git"
            },
            {
              "lessThan": "f4fcd0c1a243d449307b887fafee23921e9db5ab",
              "status": "affected",
              "version": "8d5729350b236896f51379588d9a690b7fafb8db",
              "versionType": "git"
            },
            {
              "lessThan": "0bf38372821b1526f31538a7d9811844c55c7f38",
              "status": "affected",
              "version": "e1955a94b6f17f4b058afa955a6f187eb3ed7615",
              "versionType": "git"
            },
            {
              "lessThan": "847ecd4eb3c117c3d2f13f1e7ab506543aad8183",
              "status": "affected",
              "version": "5e7b8f3c539d69b2ed5f2408e2f75e68ce7eef43",
              "versionType": "git"
            },
            {
              "lessThan": "bc90144ce8bb7fcf05ad9417c7adb4e9509d9e13",
              "status": "affected",
              "version": "299f962c0b02d048fb45d248b4da493d03f3175d",
              "versionType": "git"
            },
            {
              "lessThan": "bbf0a8e931204ecdab494a88d43b0a24a04285c5",
              "status": "affected",
              "version": "299f962c0b02d048fb45d248b4da493d03f3175d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ef7902be3f215b6bf7babe4dc9dd9a7d57dad7a7",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.184",
              "status": "affected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.148",
              "status": "affected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.101",
              "status": "affected",
              "version": "6.12.84",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.42",
              "status": "affected",
              "version": "6.18.25",
              "versionType": "semver"
            },
            {
              "lessThan": "7.1",
              "status": "affected",
              "version": "7.0.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smbacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "6.1.175",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "6.6.136",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.12.84",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.18.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "7.0.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL\n\ncheck_add_overflow() unconditionally writes the truncated sum into *d\neven on overflow, per its contract in include/linux/overflow.h.\nThe four check_add_overflow() guards in set_posix_acl_entries_dacl()\nand set_ntacl_dacl() break out of the ACE-building loops on overflow,\nbut the truncated *size is then consumed downstream at the end of\nset_ntacl_dacl():\n\n    pndacl-\u003esize = cpu_to_le16(le16_to_cpu(pndacl-\u003esize) + size);\n\nThis produces an on-wire NT ACL whose pndacl-\u003esize under-reports the\nbytes actually written by the preceding fill_ace_for_sid()/memcpy()\ncalls, yielding a malformed ACL that can trigger out-of-bounds reads\nwhen re-parsed by clients or ksmbd itself.\n\nRestore *size to its pre-addition value on each overflow branch (via\n`*size -= ace_sz` / `size -= nt_ace_size`) so that after the break,\n*size once again holds the cumulative size of the successfully-written\nACEs. The committed ACL is then truncated-but-self-consistent rather\nthan malformed.\n\nThe ksmbd DACL builders are the only check_add_overflow() sites found\nwhere an overflow path breaks out of a loop and the destination value\nis consumed afterward. The other nearby break-style cases either\nreturn -EINVAL on overflow (transport_ipc.c) or break without\nconsuming the overflowed destination value afterward (buildid.c)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:45:49.075Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8f3a7a499a7d9bb1c0f33fe78c4a4594d7e307f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4fcd0c1a243d449307b887fafee23921e9db5ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/0bf38372821b1526f31538a7d9811844c55c7f38"
        },
        {
          "url": "https://git.kernel.org/stable/c/847ecd4eb3c117c3d2f13f1e7ab506543aad8183"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc90144ce8bb7fcf05ad9417c7adb4e9509d9e13"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbf0a8e931204ecdab494a88d43b0a24a04285c5"
        }
      ],
      "title": "ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68099",
    "datePublished": "2026-08-10T11:58:13.940Z",
    "dateReserved": "2026-07-30T09:28:09.368Z",
    "dateUpdated": "2026-08-23T12:45:49.075Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68099",
      "date": "2026-09-20",
      "epss": "0.00173",
      "percentile": "0.07019"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/smbacl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "8f3a7a499a7d9bb1c0f33fe78c4a4594d7e307f4",
                    "status": "affected",
                    "version": "41e53a773db6342ac9a689ee5ba635c31744c9f0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f4fcd0c1a243d449307b887fafee23921e9db5ab",
                    "status": "affected",
                    "version": "8d5729350b236896f51379588d9a690b7fafb8db",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0bf38372821b1526f31538a7d9811844c55c7f38",
                    "status": "affected",
                    "version": "e1955a94b6f17f4b058afa955a6f187eb3ed7615",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "847ecd4eb3c117c3d2f13f1e7ab506543aad8183",
                    "status": "affected",
                    "version": "5e7b8f3c539d69b2ed5f2408e2f75e68ce7eef43",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bc90144ce8bb7fcf05ad9417c7adb4e9509d9e13",
                    "status": "affected",
                    "version": "299f962c0b02d048fb45d248b4da493d03f3175d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bbf0a8e931204ecdab494a88d43b0a24a04285c5",
                    "status": "affected",
                    "version": "299f962c0b02d048fb45d248b4da493d03f3175d",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "ef7902be3f215b6bf7babe4dc9dd9a7d57dad7a7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.1.184",
                    "status": "affected",
                    "version": "6.1.175",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.148",
                    "status": "affected",
                    "version": "6.6.136",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12.101",
                    "status": "affected",
                    "version": "6.12.84",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.18.42",
                    "status": "affected",
                    "version": "6.18.25",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "affected",
                    "version": "7.0.2",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/smbacl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.1"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.184",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL\n\ncheck_add_overflow() unconditionally writes the truncated sum into *d\neven on overflow, per its contract in include/linux/overflow.h.\nThe four check_add_overflow() guards in set_posix_acl_entries_dacl()\nand set_ntacl_dacl() break out of the ACE-building loops on overflow,\nbut the truncated *size is then consumed downstream at the end of\nset_ntacl_dacl():\n\n    pndacl-\u003esize = cpu_to_le16(le16_to_cpu(pndacl-\u003esize) + size);\n\nThis produces an on-wire NT ACL whose pndacl-\u003esize under-reports the\nbytes actually written by the preceding fill_ace_for_sid()/memcpy()\ncalls, yielding a malformed ACL that can trigger out-of-bounds reads\nwhen re-parsed by clients or ksmbd itself.\n\nRestore *size to its pre-addition value on each overflow branch (via\n`*size -= ace_sz` / `size -= nt_ace_size`) so that after the break,\n*size once again holds the cumulative size of the successfully-written\nACEs. The committed ACL is then truncated-but-self-consistent rather\nthan malformed.\n\nThe ksmbd DACL builders are the only check_add_overflow() sites found\nwhere an overflow path breaks out of a loop and the destination value\nis consumed afterward. The other nearby break-style cases either\nreturn -EINVAL on overflow (transport_ipc.c) or break without\nconsuming the overflowed destination value afterward (buildid.c)."
          }
        ],
        "id": "CVE-2026-68099",
        "lastModified": "2026-08-23T13:16:32.940",
        "metrics": {},
        "published": "2026-08-10T13:19:54.350",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0bf38372821b1526f31538a7d9811844c55c7f38"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/847ecd4eb3c117c3d2f13f1e7ab506543aad8183"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8f3a7a499a7d9bb1c0f33fe78c4a4594d7e307f4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bbf0a8e931204ecdab494a88d43b0a24a04285c5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bc90144ce8bb7fcf05ad9417c7adb4e9509d9e13"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f4fcd0c1a243d449307b887fafee23921e9db5ab"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-02T08:11:44+00:00",
      "cve": "CVE-2026-68099",
      "id": "CVE-2026-68099",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_not_affected": "275",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68099.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:42:53Z",
      "cve": "CVE-2026-68099",
      "id": "CVE-2026-68099",
      "initial_release_date": "2026-08-11T23:48:26Z",
      "product_status:known_affected": "93",
      "product_status:known_not_affected": "281",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68099",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68099.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.