https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 16:27:29 +0000 https://vulnerability.circl.lu/vuln/cve-2026-68098 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: bound DACL dedup walk to copied ACEs</p> <p>set_ntacl_dacl() can stop copying ACEs before consuming the full input DACL when size accounting overflows.</p> <p>When that happens, num_aces reflects only the ACEs that were actually copied into the output DACL, but set_posix_acl_entries_dacl() still receives nt_num_aces and uses it to walk the existing ACE array during dedup.</p> <p>That makes the dedup walk scan past the copied ACE array and inspect buffer tail that does not contain valid ACEs.</p> <p>Split the two meanings currently carried by the NT ACE count. Pass the number of copied NT ACEs to bound the dedup walk, and preserve the original &#34;input DACL had NT ACEs&#34; state separately for the Everyone/default ACL fallback.</p> <p>This keeps the dedup walk aligned with the ACEs that are actually present in the rebuilt DACL.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: bound DACL dedup walk to copied ACEs</p> <p>set_ntacl_dacl() can stop copying ACEs before consuming the full input DACL when size accounting overflows.</p> <p>When that happens, num_aces reflects only the ACEs that were actually copied into the output DACL, but set_posix_acl_entries_dacl() still receives nt_num_aces and uses it to walk the existing ACE array during dedup.</p> <p>That makes the dedup walk scan past the copied ACE array and inspect buffer tail that does not contain valid ACEs.</p> <p>Split the two meanings currently carried by the NT ACE count. Pass the number of copied NT ACEs to bound the dedup walk, and preserve the original &#34;input DACL had NT ACEs&#34; state separately for the Everyone/default ACL fallback.</p> <p>This keeps the dedup walk aligned with the ACEs that are actually present in the rebuilt DACL.</p> https://vulnerability.circl.lu/vuln/cve-2026-68098