CVE-2026-68098: Linux Kernel Privilege Escalation Flaw

CVE-2026-68098 Overview

CVE-2026-68098 is a vulnerability in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw resides in set_ntacl_dacl(), which can stop copying Access Control Entries (ACEs) before consuming the full input Discretionary Access Control List (DACL) when size accounting overflows. The downstream function set_posix_acl_entries_dacl() continues to walk the original ACE count during deduplication, reading past the copied ACE array into unrelated buffer memory. The issue affects Linux kernel builds shipping the ksmbd module and has been resolved upstream.

Critical Impact
An authenticated SMB client on the network can trigger out-of-bounds reads in the kernel, enabling information disclosure, memory corruption, or denial of service against ksmbd servers.

Affected Products

Linux kernel ksmbd SMB server module
Stable kernel branches prior to the commits referenced in the fix set
Distributions shipping kernels with ksmbd enabled

Discovery Timeline

2026-08-10 - CVE-2026-68098 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68098

Vulnerability Analysis

The vulnerability is an out-of-bounds read caused by desynchronization between two counters that describe the ACE array in a rebuilt DACL. The ksmbd server processes NT security descriptors sent by SMB clients and translates their DACLs into POSIX access control lists. During this translation, set_ntacl_dacl() copies each ACE into an output buffer while accounting for the running size.

When size accounting overflows, set_ntacl_dacl() aborts copying early. The variable num_aces then reflects only the successfully copied ACEs, but nt_num_aces still carries the original count from the input DACL. set_posix_acl_entries_dacl() receives nt_num_aces and iterates that many entries during deduplication, scanning past the end of the copied array and dereferencing bytes in the buffer tail that do not contain valid ACE structures.

Root Cause

The root cause is a single variable overloaded with two distinct meanings: the number of ACEs actually written into the rebuilt DACL, and the fact that the input DACL contained NT ACEs at all. The fix splits these responsibilities. It passes the copied ACE count to bound the dedup walk while preserving the original "input DACL had NT ACEs" state separately for the Everyone/default ACL fallback path.

Attack Vector

Exploitation requires network access to an exposed ksmbd share and low-privileged SMB credentials. An attacker crafts an SMB request containing a security descriptor with a DACL sized to trigger the size-accounting abort inside set_ntacl_dacl(). Because the dedup walk then reads uninitialized or attacker-influenced buffer memory, the flaw can be leveraged for kernel memory disclosure or to corrupt subsequent ACL processing, impacting confidentiality, integrity, and availability of the host.

The fix is described in the upstream commits, including 58d97fcd0bf1 and a0ebdaa79e10.

Detection Methods for CVE-2026-68098

Indicators of Compromise

Kernel oops, KASAN slab-out-of-bounds reports, or general protection faults originating in set_posix_acl_entries_dacl or set_ntacl_dacl.
Unexpected ksmbd worker thread crashes or restarts under active SMB sessions.
SMB clients sending unusually large or malformed NT security descriptors to file shares.

Detection Strategies

Monitor dmesg and /var/log/kern.log for stack traces referencing ksmbd ACL handling functions.
Inspect SMB traffic for SET_INFO and CREATE requests carrying oversized DACL structures.
Correlate authenticated SMB sessions against subsequent kernel error events on the same host.

Monitoring Recommendations

Ship kernel logs and SMB audit events into a centralized SIEM for correlation across the fleet.
Track kernel module version and patch state for ksmbd-enabled hosts as an ongoing hygiene metric.
Alert on new external network exposure of TCP/445 on Linux servers running ksmbd.

How to Mitigate CVE-2026-68098

Immediate Actions Required

Apply the stable kernel updates that include the referenced ksmbd DACL fix commits from your distribution vendor.
Restrict SMB access to trusted network segments and require authenticated, least-privilege accounts.
Disable the ksmbd module on systems that do not require an in-kernel SMB server, preferring userspace Samba where possible.

Patch Information

The fix is committed to the upstream Linux stable tree across multiple branches. Relevant commits include 58d97fcd0bf1, 6d9d7aa4a2c9, a0ebdaa79e10, b057a851129c, and f1eba60db813. Rebuild or update to a kernel package that includes these commits.

Workarounds

Unload the ksmbd module (modprobe -r ksmbd) on hosts where the SMB server is not required.
Block inbound TCP/445 at host and perimeter firewalls for untrusted networks until patched kernels are deployed.
Enforce SMB signing and strong authentication to reduce the pool of clients able to reach the vulnerable code path.

bash

# Check whether ksmbd is loaded and disable if unused
lsmod | grep ksmbd
sudo systemctl stop ksmbd.service 2>/dev/null
sudo modprobe -r ksmbd
echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/disable-ksmbd.conf

# Restrict SMB exposure at the host firewall
sudo nft add rule inet filter input tcp dport 445 drop