CVE-2026-68097 (GCVE-0-2026-68097)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:58 – Updated: 2026-08-17 04:58
VLAI
Title
ksmbd: validate ACE size against SID sub-authorities
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ACE size against SID sub-authorities set_ntacl_dacl() validates sid.num_subauth before copying an ACE, but does not verify that the declared ACE size contains all sub-authorities described by that field. An undersized ACE can therefore be copied and later make the POSIX ACL deduplication walk inspect data beyond the copied ACE boundary. The existing initial bound check is also too small. It only ensures that the ACE size field is accessible before set_ntacl_dacl() reads sid.num_subauth farther into the input buffer. Require enough input for the fixed SID header before accessing num_subauth, reject ACEs smaller than that header, and skip ACEs whose declared size cannot contain the complete SID. This makes the validation consistent with the other ACE walk paths.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < b7cb5bf0855470799f12da825de91e48951b3876 (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 62d80d7c2d9428085e7458ad4c06ca8c0984039b (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 337022d9dfac441c3b35e4455a51aa981996e02e (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 61fd3559199f7fa693dcbff35e59477e24af041a (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 5152c6d49e3fd4e9f2e857c57527aead752f1f87 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smbacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b7cb5bf0855470799f12da825de91e48951b3876",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "62d80d7c2d9428085e7458ad4c06ca8c0984039b",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "337022d9dfac441c3b35e4455a51aa981996e02e",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "61fd3559199f7fa693dcbff35e59477e24af041a",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "5152c6d49e3fd4e9f2e857c57527aead752f1f87",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smbacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate ACE size against SID sub-authorities\n\nset_ntacl_dacl() validates sid.num_subauth before copying an ACE, but\ndoes not verify that the declared ACE size contains all sub-authorities\ndescribed by that field. An undersized ACE can therefore be copied\nand later make the POSIX ACL deduplication walk inspect data beyond\nthe copied ACE boundary.\n\nThe existing initial bound check is also too small. It only ensures\nthat the ACE size field is accessible before set_ntacl_dacl() reads\nsid.num_subauth farther into the input buffer.\n\nRequire enough input for the fixed SID header before accessing\nnum_subauth, reject ACEs smaller than that header, and skip ACEs\nwhose declared size cannot contain the complete SID. This makes the\nvalidation consistent with the other ACE walk paths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in ksmbd ACL handling reached from SMB2 network commands on TCP/445; build_sec_desc() is invoked from SMB2_QUERY_INFO(SecInfo) after reading attacker-supplied NT security descriptors stored via the server.\nAC:L - An attacker fully controls ACE size and SID sub-authority fields in SMB SET_INFO/CREATE_SD_BUFFER payloads; parse_sec_desc() stores the raw SD despite parse_dacl() skipping bad ACEs, so a subsequent QUERY_INFO reliably triggers the flawed copy and dedup walk.\nPR:L - Exploitation requires an authenticated SMB session and FILE_WRITE_DAC or FILE_WRITE_OWNER to plant the malformed SD (or CREATE_SD_BUFFER on create), but no server administrator or host root privileges; guest/writable share access is sufficient.\nUI:N - No end-user interaction is required beyond the attacker (or any client) issuing normal SMB file security operations against ksmbd; no mount, open-in-client, or other victim action is needed.\nS:U - The vulnerability is confined to kernel ksmbd processing of SMB security descriptors and does not cross a VM, container, or IOMMU security boundary; impact remains within the kernel/host security authority.\nC:H - Undersized ACEs are copied with attacker-controlled num_subauth, and set_posix_acl_entries_dacl() reads ntace-\u003esid.sub_auth[num_subauth-1] and advances by attacker-controlled ACE size, causing out-of-bounds kernel heap reads and a comparison oracle that can disclose kernel memory.\nI:H - The same inconsistent ACE metadata and unbounded dedup pointer arithmetic corrupt kernel heap ACL construction during security-descriptor rebuild; per kernel guidance, this class of memory corruption is treated as potentially chainable to arbitrary kernel writes and code execution.\nA:H - Walking ACEs with attacker-controlled size fields against a truncated copy can read beyond the allocated scratch buffer and fault the kernel (oops/panic), and the bug class is triggered on every QUERY_INFO that rebuilds DACLs from poisoned xattrs."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:58:45.888Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b7cb5bf0855470799f12da825de91e48951b3876"
        },
        {
          "url": "https://git.kernel.org/stable/c/62d80d7c2d9428085e7458ad4c06ca8c0984039b"
        },
        {
          "url": "https://git.kernel.org/stable/c/337022d9dfac441c3b35e4455a51aa981996e02e"
        },
        {
          "url": "https://git.kernel.org/stable/c/61fd3559199f7fa693dcbff35e59477e24af041a"
        },
        {
          "url": "https://git.kernel.org/stable/c/5152c6d49e3fd4e9f2e857c57527aead752f1f87"
        }
      ],
      "title": "ksmbd: validate ACE size against SID sub-authorities",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68097",
    "datePublished": "2026-08-10T11:58:11.289Z",
    "dateReserved": "2026-07-30T09:28:09.368Z",
    "dateUpdated": "2026-08-17T04:58:45.888Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68097",
      "date": "2026-08-20",
      "epss": "0.00414",
      "percentile": "0.34802"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68097\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:19:54.047\",\"lastModified\":\"2026-08-17T05:18:09.020\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: validate ACE size against SID sub-authorities\\n\\nset_ntacl_dacl() validates sid.num_subauth before copying an ACE, but\\ndoes not verify that the declared ACE size contains all sub-authorities\\ndescribed by that field. An undersized ACE can therefore be copied\\nand later make the POSIX ACL deduplication walk inspect data beyond\\nthe copied ACE boundary.\\n\\nThe existing initial bound check is also too small. It only ensures\\nthat the ACE size field is accessible before set_ntacl_dacl() reads\\nsid.num_subauth farther into the input buffer.\\n\\nRequire enough input for the fixed SID header before accessing\\nnum_subauth, reject ACEs smaller than that header, and skip ACEs\\nwhose declared size cannot contain the complete SID. This makes the\\nvalidation consistent with the other ACE walk paths.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/server/smbacl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"b7cb5bf0855470799f12da825de91e48951b3876\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"62d80d7c2d9428085e7458ad4c06ca8c0984039b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"337022d9dfac441c3b35e4455a51aa981996e02e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"61fd3559199f7fa693dcbff35e59477e24af041a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"5152c6d49e3fd4e9f2e857c57527aead752f1f87\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/server/smbacl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.148\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/337022d9dfac441c3b35e4455a51aa981996e02e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5152c6d49e3fd4e9f2e857c57527aead752f1f87\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/61fd3559199f7fa693dcbff35e59477e24af041a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/62d80d7c2d9428085e7458ad4c06ca8c0984039b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b7cb5bf0855470799f12da825de91e48951b3876\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-11T23:48:30Z",
      "cve": "CVE-2026-68097",
      "id": "CVE-2026-68097",
      "initial_release_date": "2026-08-11T23:48:30Z",
      "product_status:known_affected": "112",
      "product_status:known_not_affected": "184",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68097",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68097.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.