Executive brief
The ksmbd SMB server component in the Linux kernel validates ACE (Access Control Entry) structures used to enforce file permissions over the network. A flaw in the validation logic allows undersized ACE structures to be processed, causing the kernel to read beyond the copied data boundary when deduplicating POSIX ACLs. This can lead to kernel crash or information disclosure on systems exposing file shares via Samba or ksmbd.
Technical details
The vulnerability is a buffer over-read (CWE-126) in the set_ntacl_dacl() function of fs/smb/server/smbacl.c. The code validates the num_subauth field in a SID (Security Identifier) within an ACE, but failed to verify that the ACE's declared size was large enough to contain all sub-authorities described by that field. An attacker sending a specially crafted SMB request with undersized ACE structures could cause the POSIX ACL deduplication code to read memory beyond the ACE boundary. The vulnerability requires network access to a ksmbd-exposed share. The fix strengthens the initial bounds check and adds validation that the ACE size can contain the complete SID structure including all sub-authorities before processing.
Affected products
- Linux kernel multiple versions through 6.9, patched in stable branches
Timeline
- 2026-07-22: disclosed: Patch 5152c6d49e3fd4e9f2e857c57527aead752f1f87 committed upstream
- 2026-08-03: patched: Stable kernel backport 337022d9dfac441c3b35e4455a51aa981996e02e
- 2026-08-10: advisory: CVE-2026-68097 published