CVE-2026-68097: Linux Kernel Privilege Escalation Flaw

CVE-2026-68097 Overview

CVE-2026-68097 is a validation flaw in the Linux kernel's ksmbd in-kernel SMB3 server. The set_ntacl_dacl() function fails to verify that a declared Access Control Entry (ACE) size can contain all sub-authorities described by its Security Identifier (SID) header. An authenticated remote attacker can send a crafted ACL that causes the POSIX ACL deduplication walk to read memory beyond the copied ACE boundary. The issue affects confidentiality, integrity, and availability of the target host.

Critical Impact
A remote authenticated attacker can trigger out-of-bounds reads in kernel memory through crafted SMB ACL data, potentially leading to information disclosure or kernel memory corruption.

Affected Products

Linux kernel ksmbd server module
Distributions shipping vulnerable kernel builds with ksmbd enabled
SMB shares exposed by hosts running ksmbd

Discovery Timeline

2026-08-10 - CVE-2026-68097 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68097

Vulnerability Analysis

The vulnerability resides in the set_ntacl_dacl() function within the ksmbd SMB server. The function validates sid.num_subauth before copying an ACE but does not confirm that the declared ACE size covers all sub-authorities described by that field. An undersized ACE passes the initial check and is copied into a working buffer. The subsequent POSIX ACL deduplication walk then inspects data beyond the copied ACE boundary, resulting in out-of-bounds memory access.

The existing initial bound check is also insufficient. It only ensures that the ACE size field itself is accessible before set_ntacl_dacl() dereferences sid.num_subauth deeper in the input buffer. Attackers who can authenticate to an SMB share can supply crafted ACLs to exercise this path.

The upstream fix requires enough input for the fixed SID header before accessing num_subauth, rejects ACEs smaller than that header, and skips ACEs whose declared size cannot contain the complete SID. This aligns validation with the other ACE walk paths.

Root Cause

The root cause is improper input validation [CWE-20] combined with an out-of-bounds read [CWE-125]. The parser trusted the declared ACE length without cross-checking against the number of sub-authorities that must fit inside it.

Attack Vector

Exploitation requires network access to an SMB service exported by ksmbd and low-privileged authenticated access. The attacker submits a specially crafted security descriptor containing an ACE whose declared size is smaller than the SID header plus the claimed sub-authorities. No user interaction is required.

See the upstream fixes for technical details: Kernel Git Commit 337022d, Kernel Git Commit 5152c6d, Kernel Git Commit 61fd355, Kernel Git Commit 62d80d7, and Kernel Git Commit b7cb5bf.

Detection Methods for CVE-2026-68097

Indicators of Compromise

Unexpected ksmbd kernel warnings, KASAN reports, or oops entries in dmesg referencing set_ntacl_dacl or POSIX ACL deduplication paths.
SMB clients issuing repeated SET_INFO or security descriptor operations with malformed ACLs against ksmbd shares.
Unexpected ksmbd.mountd or kernel worker crashes coinciding with SMB traffic from a specific source.

Detection Strategies

Monitor kernel logs for stack traces originating in smb/server/smbacl.c or in ACE parsing routines.
Inspect SMB traffic for security descriptors whose ACE AceSize value is inconsistent with the embedded SID SubAuthorityCount.
Correlate authenticated SMB sessions against baseline behavior to identify anomalous ACL write operations.

Monitoring Recommendations

Ingest dmesg, auditd, and SMB access logs into a centralized analytics platform to correlate kernel faults with source IPs and user principals.
Enable SMB session auditing on hosts running ksmbd and alert on repeated failed or malformed metadata operations.
Track kernel package versions across the fleet to identify hosts still running vulnerable ksmbd builds.

How to Mitigate CVE-2026-68097

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the ksmbd commits and reboot into the patched kernel.
If patching is not immediately possible, disable the ksmbd module on hosts that do not require in-kernel SMB serving.
Restrict SMB access at the network layer to trusted management ranges and enforce strong authentication on all shares.

Patch Information

The fix is available in the upstream Linux stable trees through commits 337022d, 5152c6d, 61fd355, 62d80d7, and b7cb5bf. Distribution vendors backport these patches into their supported kernel branches. Rebuild or upgrade to a kernel that includes these commits and validate the version with uname -r after reboot.

Workarounds

Unload the module with modprobe -r ksmbd and blocklist it where SMB service is not needed.
Replace ksmbd with a user-space SMB server such as Samba on affected hosts until a patched kernel is deployed.
Restrict SMB (TCP 445) exposure with host and network firewalls to reduce the attacker population able to authenticate.

bash

# Disable ksmbd until a patched kernel is deployed
sudo systemctl stop ksmbd.service
sudo systemctl disable ksmbd.service
sudo modprobe -r ksmbd
echo "blacklist ksmbd" | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf

# Restrict SMB access at the host firewall
sudo iptables -A INPUT -p tcp --dport 445 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 445 -j DROP