CVE-2026-68100: ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate numsubauth when copying ACE in setntacldacl
setntacldacl() copies each ACE from the attacker-controlled stored security descriptor verbatim into the response DACL without checking sid.numsubauth. The ACE bytes (including an unchecked numsubauth) originate from an authenticated SMB2SETINFO(SecInfo=DACL) that is stored raw via ksmbdvfssetsdxattr(); parsedacl() rejects a bad ACE with break rather than an error, so parsesecdesc() still returns success and the malformed SD reaches the xattr intact.
On a subsequent SMB2QUERYINFO(SecInfo=DACL) for an inode carrying a POSIX access ACL, buildsecdesc() -> setntacldacl() -> setposixaclentriesdacl() walks the copied ACEs and reads
ntace->sid.subauth[ntace->sid.numsubauth - 1]
with numsubauth taken straight from the stored SD. Since subauth[] is fixed at SIDMAXSUBAUTHORITIES (15), a crafted numsubauth (e.g. 255) drives an out-of-bounds heap read of ~1 KB with an offset fully controlled by an authenticated client.
The sibling functions already gate this field: parsedacl() -- numsubauth == 0 || > SIDMAXSUBAUTHORITIES parsesid() -- numsubauth > SIDMAXSUBAUTHORITIES smbcopysid() -- mint(u8, numsubauth, SIDMAXSUBAUTHORITIES) setntacldacl() is the lone inconsistent path that omits the check.
Add the same numsubauth validation in setntacldacl() before copying the ACE, matching the gate already enforced by parsedacl().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In set_ntacl_dacl(), validate the ACE SID field num_subauth before copying, matching the gating already used by sibling functions parse_dacl() (num_subauth == 0 || > SID_MAX_SUB_AUTHORITIES) and parse_sid() (num_subauth > SID_MAX_SUB_AUTHORITIES).
Linux kernel (ksmbd) set_ntacl_dacl() num_subauth validation when copying ACEs (ntace->sid.sub_auth[ntace->sid.num_subauth - 1]) = Add the same num_subauth validation as in parse_dacl()/parse_sid(): reject num_subauth == 0 or num_subauth > SID_MAX_SUB_AUTHORITIES before copying ACE bytes
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68100?
CVE-2026-68100 has been assigned a risk score of 23.
How does CVE-2026-68100 impact the Linux kernel?
CVE-2026-68100 allows an attacker to exploit vulnerabilities in the ACL handling of ksmbd by manipulating stored security descriptors.
How do I fix CVE-2026-68100?
To fix CVE-2026-68100, update your Linux kernel to the latest stable version where the vulnerability has been resolved.
Which versions of the Linux kernel are affected by CVE-2026-68100?
CVE-2026-68100 affects multiple versions of the Linux kernel that include the ksmbd service prior to the fix.
What are the potential consequences of exploiting CVE-2026-68100?
Exploitation of CVE-2026-68100 could lead to unauthorized access or modification of resources by manipulating access control entries.