CVE-2026-68100

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ksmbd module where the set ntacl dacl() function copies Access Control Entries (ACE) from a stored security descriptor into the response Discretionary Access Control List (DACL) without validating the num subauth variable. This occurs because parse dacl() handles bad ACEs with a break instead of an error, allowing malformed security descriptors to be stored via ksmbd vfs set sd xattr(). When an authenticated client subsequently triggers an SMB2 QUERY INFO request for an inode with a POSIX access ACL, the system executes a sequence of functions including build sec desc(), set ntacl dacl(), and set posix acl entries dacl(). Because the sub auth[] array has a fixed size of 15, a crafted num subauth value (such as 255) can lead to an out-of-bounds heap read of approximately 1 KB, with the offset controlled by the authenticated client.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.