CVE-2026-68097 (GCVE-0-2026-68097)
Vulnerability from cvelistv5
Published
2026-08-10 11:58
Modified
2026-08-17 04:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate ACE size against SID sub-authorities
set_ntacl_dacl() validates sid.num_subauth before copying an ACE, but
does not verify that the declared ACE size contains all sub-authorities
described by that field. An undersized ACE can therefore be copied
and later make the POSIX ACL deduplication walk inspect data beyond
the copied ACE boundary.
The existing initial bound check is also too small. It only ensures
that the ACE size field is accessible before set_ntacl_dacl() reads
sid.num_subauth farther into the input buffer.
Require enough input for the fixed SID header before accessing
num_subauth, reject ACEs smaller than that header, and skip ACEs
whose declared size cannot contain the complete SID. This makes the
validation consistent with the other ACE walk paths.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smbacl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b7cb5bf0855470799f12da825de91e48951b3876",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "62d80d7c2d9428085e7458ad4c06ca8c0984039b",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "337022d9dfac441c3b35e4455a51aa981996e02e",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "61fd3559199f7fa693dcbff35e59477e24af041a",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "5152c6d49e3fd4e9f2e857c57527aead752f1f87",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smbacl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate ACE size against SID sub-authorities\n\nset_ntacl_dacl() validates sid.num_subauth before copying an ACE, but\ndoes not verify that the declared ACE size contains all sub-authorities\ndescribed by that field. An undersized ACE can therefore be copied\nand later make the POSIX ACL deduplication walk inspect data beyond\nthe copied ACE boundary.\n\nThe existing initial bound check is also too small. It only ensures\nthat the ACE size field is accessible before set_ntacl_dacl() reads\nsid.num_subauth farther into the input buffer.\n\nRequire enough input for the fixed SID header before accessing\nnum_subauth, reject ACEs smaller than that header, and skip ACEs\nwhose declared size cannot contain the complete SID. This makes the\nvalidation consistent with the other ACE walk paths."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in ksmbd ACL handling reached from SMB2 network commands on TCP/445; build_sec_desc() is invoked from SMB2_QUERY_INFO(SecInfo) after reading attacker-supplied NT security descriptors stored via the server.\nAC:L - An attacker fully controls ACE size and SID sub-authority fields in SMB SET_INFO/CREATE_SD_BUFFER payloads; parse_sec_desc() stores the raw SD despite parse_dacl() skipping bad ACEs, so a subsequent QUERY_INFO reliably triggers the flawed copy and dedup walk.\nPR:L - Exploitation requires an authenticated SMB session and FILE_WRITE_DAC or FILE_WRITE_OWNER to plant the malformed SD (or CREATE_SD_BUFFER on create), but no server administrator or host root privileges; guest/writable share access is sufficient.\nUI:N - No end-user interaction is required beyond the attacker (or any client) issuing normal SMB file security operations against ksmbd; no mount, open-in-client, or other victim action is needed.\nS:U - The vulnerability is confined to kernel ksmbd processing of SMB security descriptors and does not cross a VM, container, or IOMMU security boundary; impact remains within the kernel/host security authority.\nC:H - Undersized ACEs are copied with attacker-controlled num_subauth, and set_posix_acl_entries_dacl() reads ntace-\u003esid.sub_auth[num_subauth-1] and advances by attacker-controlled ACE size, causing out-of-bounds kernel heap reads and a comparison oracle that can disclose kernel memory.\nI:H - The same inconsistent ACE metadata and unbounded dedup pointer arithmetic corrupt kernel heap ACL construction during security-descriptor rebuild; per kernel guidance, this class of memory corruption is treated as potentially chainable to arbitrary kernel writes and code execution.\nA:H - Walking ACEs with attacker-controlled size fields against a truncated copy can read beyond the allocated scratch buffer and fault the kernel (oops/panic), and the bug class is triggered on every QUERY_INFO that rebuilds DACLs from poisoned xattrs."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:58:45.888Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b7cb5bf0855470799f12da825de91e48951b3876"
},
{
"url": "https://git.kernel.org/stable/c/62d80d7c2d9428085e7458ad4c06ca8c0984039b"
},
{
"url": "https://git.kernel.org/stable/c/337022d9dfac441c3b35e4455a51aa981996e02e"
},
{
"url": "https://git.kernel.org/stable/c/61fd3559199f7fa693dcbff35e59477e24af041a"
},
{
"url": "https://git.kernel.org/stable/c/5152c6d49e3fd4e9f2e857c57527aead752f1f87"
}
],
"title": "ksmbd: validate ACE size against SID sub-authorities",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68097",
"datePublished": "2026-08-10T11:58:11.289Z",
"dateReserved": "2026-07-30T09:28:09.368Z",
"dateUpdated": "2026-08-17T04:58:45.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…