Vulnerability-Lookup

CVE-2026-68098 (GCVE-0-2026-68098)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:58 – Updated: 2026-08-10 11:58

Title

ksmbd: bound DACL dedup walk to copied ACEs

Summary

In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound DACL dedup walk to copied ACEs set_ntacl_dacl() can stop copying ACEs before consuming the full input DACL when size accounting overflows. When that happens, num_aces reflects only the ACEs that were actually copied into the output DACL, but set_posix_acl_entries_dacl() still receives nt_num_aces and uses it to walk the existing ACE array during dedup. That makes the dedup walk scan past the copied ACE array and inspect buffer tail that does not contain valid ACEs. Split the two meanings currently carried by the NT ACE count. Pass the number of copied NT ACEs to bound the dedup walk, and preserve the original "input DACL had NT ACEs" state separately for the Everyone/default ACL fallback. This keeps the dedup walk aligned with the ACEs that are actually present in the rebuilt DACL.

Severity

No CVSS data available.

Assigner

Linux

References

5 references

URL	Tags
https://git.kernel.org/stable/c/6d9d7aa4a2c99c31a…
https://git.kernel.org/stable/c/b057a851129c6a084…
https://git.kernel.org/stable/c/f1eba60db813ec287…
https://git.kernel.org/stable/c/a0ebdaa79e10210d4…
https://git.kernel.org/stable/c/58d97fcd0bf1aee69…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6d9d7aa4a2c99c31acfa28921c30b684110cf66c (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b057a851129c6a084e7e393b62ca3abf6c2660bc (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f1eba60db813ec28732bf18b5f0a67ebac9c3100 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a0ebdaa79e10210d4e8ed9fe138e8f4d569719e3 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 58d97fcd0bf1aee694e244cc28635b9df95b543b (git) Affected: 0 , < 6.6.148 (semver) Affected: 0 , < 6.12.101 (semver) Affected: 0 , < 6.18.42 (semver) Affected: 0 , < 7.1.6 (semver)
Linux	Linux	Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc5 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smbacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6d9d7aa4a2c99c31acfa28921c30b684110cf66c",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b057a851129c6a084e7e393b62ca3abf6c2660bc",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f1eba60db813ec28732bf18b5f0a67ebac9c3100",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a0ebdaa79e10210d4e8ed9fe138e8f4d569719e3",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "58d97fcd0bf1aee694e244cc28635b9df95b543b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.148",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.101",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.42",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smbacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: bound DACL dedup walk to copied ACEs\n\nset_ntacl_dacl() can stop copying ACEs before consuming the full input\nDACL when size accounting overflows.\n\nWhen that happens, num_aces reflects only the ACEs that were actually\ncopied into the output DACL, but set_posix_acl_entries_dacl() still\nreceives nt_num_aces and uses it to walk the existing ACE array during\ndedup.\n\nThat makes the dedup walk scan past the copied ACE array and inspect\nbuffer tail that does not contain valid ACEs.\n\nSplit the two meanings currently carried by the NT ACE count. Pass the\nnumber of copied NT ACEs to bound the dedup walk, and preserve the\noriginal \"input DACL had NT ACEs\" state separately for the\nEveryone/default ACL fallback.\n\nThis keeps the dedup walk aligned with the ACEs that are actually\npresent in the rebuilt DACL."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T11:58:12.768Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6d9d7aa4a2c99c31acfa28921c30b684110cf66c"
        },
        {
          "url": "https://git.kernel.org/stable/c/b057a851129c6a084e7e393b62ca3abf6c2660bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1eba60db813ec28732bf18b5f0a67ebac9c3100"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0ebdaa79e10210d4e8ed9fe138e8f4d569719e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/58d97fcd0bf1aee694e244cc28635b9df95b543b"
        }
      ],
      "title": "ksmbd: bound DACL dedup walk to copied ACEs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68098",
    "datePublished": "2026-08-10T11:58:12.768Z",
    "dateReserved": "2026-07-30T09:28:09.368Z",
    "dateUpdated": "2026-08-10T11:58:12.768Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68098\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:19:54.200\",\"lastModified\":\"2026-08-10T13:19:54.200\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: bound DACL dedup walk to copied ACEs\\n\\nset_ntacl_dacl() can stop copying ACEs before consuming the full input\\nDACL when size accounting overflows.\\n\\nWhen that happens, num_aces reflects only the ACEs that were actually\\ncopied into the output DACL, but set_posix_acl_entries_dacl() still\\nreceives nt_num_aces and uses it to walk the existing ACE array during\\ndedup.\\n\\nThat makes the dedup walk scan past the copied ACE array and inspect\\nbuffer tail that does not contain valid ACEs.\\n\\nSplit the two meanings currently carried by the NT ACE count. Pass the\\nnumber of copied NT ACEs to bound the dedup walk, and preserve the\\noriginal \\\"input DACL had NT ACEs\\\" state separately for the\\nEveryone/default ACL fallback.\\n\\nThis keeps the dedup walk aligned with the ACEs that are actually\\npresent in the rebuilt DACL.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/server/smbacl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"6d9d7aa4a2c99c31acfa28921c30b684110cf66c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"b057a851129c6a084e7e393b62ca3abf6c2660bc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"f1eba60db813ec28732bf18b5f0a67ebac9c3100\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"a0ebdaa79e10210d4e8ed9fe138e8f4d569719e3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"58d97fcd0bf1aee694e244cc28635b9df95b543b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6.148\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.12.101\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18.42\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.1.6\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/server/smbacl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6.148\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/58d97fcd0bf1aee694e244cc28635b9df95b543b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6d9d7aa4a2c99c31acfa28921c30b684110cf66c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a0ebdaa79e10210d4e8ed9fe138e8f4d569719e3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b057a851129c6a084e7e393b62ca3abf6c2660bc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f1eba60db813ec28732bf18b5f0a67ebac9c3100\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}

GHSA-V5FH-FF84-CFPV

Vulnerability from github – Published: 2026-08-10 15:33 – Updated: 2026-08-10 15:33

Details

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: bound DACL dedup walk to copied ACEs

set_ntacl_dacl() can stop copying ACEs before consuming the full input DACL when size accounting overflows.

When that happens, num_aces reflects only the ACEs that were actually copied into the output DACL, but set_posix_acl_entries_dacl() still receives nt_num_aces and uses it to walk the existing ACE array during dedup.

That makes the dedup walk scan past the copied ACE array and inspect buffer tail that does not contain valid ACEs.

Split the two meanings currently carried by the NT ACE count. Pass the number of copied NT ACEs to bound the dedup walk, and preserve the original "input DACL had NT ACEs" state separately for the Everyone/default ACL fallback.

This keeps the dedup walk aligned with the ACEs that are actually present in the rebuilt DACL.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-68098"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-10T13:19:54Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: bound DACL dedup walk to copied ACEs\n\nset_ntacl_dacl() can stop copying ACEs before consuming the full input\nDACL when size accounting overflows.\n\nWhen that happens, num_aces reflects only the ACEs that were actually\ncopied into the output DACL, but set_posix_acl_entries_dacl() still\nreceives nt_num_aces and uses it to walk the existing ACE array during\ndedup.\n\nThat makes the dedup walk scan past the copied ACE array and inspect\nbuffer tail that does not contain valid ACEs.\n\nSplit the two meanings currently carried by the NT ACE count. Pass the\nnumber of copied NT ACEs to bound the dedup walk, and preserve the\noriginal \"input DACL had NT ACEs\" state separately for the\nEveryone/default ACL fallback.\n\nThis keeps the dedup walk aligned with the ACEs that are actually\npresent in the rebuilt DACL.",
  "id": "GHSA-v5fh-ff84-cfpv",
  "modified": "2026-08-10T15:33:35Z",
  "published": "2026-08-10T15:33:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68098"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/58d97fcd0bf1aee694e244cc28635b9df95b543b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6d9d7aa4a2c99c31acfa28921c30b684110cf66c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a0ebdaa79e10210d4e8ed9fe138e8f4d569719e3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b057a851129c6a084e7e393b62ca3abf6c2660bc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f1eba60db813ec28732bf18b5f0a67ebac9c3100"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-68098 (GCVE-0-2026-68098)

GHSA-V5FH-FF84-CFPV

Tags

Sightings

Nomenclature