CVE-2026-68099: Linux Kernel Privilege Escalation Flaw

CVE-2026-68099 Overview

CVE-2026-68099 is a Linux kernel vulnerability in the ksmbd in-kernel SMB server. The flaw affects the Discretionary Access Control List (DACL) builders in set_posix_acl_entries_dacl() and set_ntacl_dacl(). When check_add_overflow() detects an overflow, it still writes the truncated sum to the destination. The ksmbd code breaks out of the ACE-building loop, but the truncated size value is then consumed downstream. This produces an on-wire NT ACL whose pndacl->size under-reports the bytes written by preceding fill_ace_for_sid() and memcpy() calls. The result is a malformed ACL that can trigger out-of-bounds reads when re-parsed by clients or by ksmbd itself.

Critical Impact
Malformed NT ACLs generated by the ksmbd server can cause out-of-bounds reads during ACL re-parsing on the server or connected SMB clients.

Affected Products

Linux kernel with ksmbd (in-kernel SMB3 server) enabled
Stable branches referenced by the upstream fix commits
SMB shares served through ksmbd with NT ACL translation

Discovery Timeline

2026-08-10 - CVE-2026-68099 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68099

Vulnerability Analysis

The vulnerability resides in the ksmbd DACL builders that translate POSIX ACLs into NT ACLs for SMB responses. The helper check_add_overflow() from include/linux/overflow.h unconditionally writes the truncated sum into its destination, even when the addition overflows. The four check_add_overflow() guards in set_posix_acl_entries_dacl() and set_ntacl_dacl() break out of the ACE-building loops on overflow. However, *size has already been mutated with the truncated value at the point of the break.

At the end of set_ntacl_dacl(), the code executes pndacl->size = cpu_to_le16(le16_to_cpu(pndacl->size) + size);. Because size now reflects the truncated sum rather than the cumulative bytes of successfully written ACEs, pndacl->size under-reports the true payload. The header length no longer matches the ACE bytes actually placed in the buffer by fill_ace_for_sid() and memcpy(). Downstream parsers that trust the ACL header walk past the intended boundary, producing out-of-bounds reads.

Root Cause

The root cause is a numeric truncation error combined with improper handling of the check_add_overflow() contract. The ksmbd code assumed the destination remains unchanged on overflow, but the helper writes the truncated result before returning true. Consuming that truncated size after breaking out of the loop yields a length field that is smaller than the data already appended, creating a self-inconsistent ACL structure.

Attack Vector

An attacker able to interact with a ksmbd share can craft filesystem states or requests that cause the ACE aggregation to overflow the 16-bit ACL size field. The server then serializes a malformed NT ACL and returns it to the client. Re-parsing the ACL on either side reads bytes outside the declared region, disclosing adjacent kernel memory or destabilizing the SMB session.

No public exploit code is available. Refer to the upstream commits for the exact patched call sites: Kernel Git Commit 0bf3837, Kernel Git Commit 847ecd4, Kernel Git Commit bbf0a8e, Kernel Git Commit bc90144, and Kernel Git Commit f4fcd0c.

Detection Methods for CVE-2026-68099

Indicators of Compromise

SMB clients logging ACL parsing errors or oversized ACE walks against ksmbd shares.
Kernel warnings, KASAN out-of-bounds read reports, or oops messages referencing set_ntacl_dacl or fill_ace_for_sid.
Unexpected ksmbd process crashes or connection resets during ACL retrieval operations.

Detection Strategies

Enable KASAN on test kernels to catch out-of-bounds reads triggered while serializing or parsing NT ACLs.
Compare ksmbd kernel module version and build hash against the upstream fix commits before exposing SMB services.
Monitor dmesg for warnings tied to ACL construction and clients reporting malformed SECURITY_DESCRIPTOR responses.

Monitoring Recommendations

Ingest kernel logs from SMB servers into a centralized log platform and alert on ksmbd stack traces.
Track SMB2 QUERY_INFO and SET_INFO requests with SecurityInformation set to DACL_SECURITY_INFORMATION for anomalous volume against a single share.
Baseline the size distribution of returned Security Descriptors and alert on abnormally small pndacl->size fields following large ACE counts.

How to Mitigate CVE-2026-68099

Immediate Actions Required

Update the Linux kernel to a stable release that includes the ksmbd DACL size-restore fix.
Disable the ksmbd module on hosts where SMB service is not required until the patched kernel is deployed.
Restrict SMB traffic to trusted network segments and authenticated users while patching is scheduled.

Patch Information

The upstream fix restores *size to its pre-addition value on each overflow branch using *size -= ace_sz and size -= nt_ace_size. After the loop breaks, *size again holds the cumulative size of successfully written ACEs, producing a truncated but self-consistent ACL. Apply one of the fix commits appropriate to your stable branch: Kernel Git Commit 0bf3837, Kernel Git Commit 847ecd4, Kernel Git Commit bbf0a8e, Kernel Git Commit bc90144, or Kernel Git Commit f4fcd0c.

Workarounds

Unload the ksmbd module with modprobe -r ksmbd and prevent auto-load until a patched kernel is available.
Migrate SMB service temporarily to a userspace server such as Samba on unaffected hosts.
Block inbound TCP/445 at the perimeter and restrict internal access to authenticated management networks.

bash

# Disable ksmbd until the patched kernel is deployed
sudo systemctl stop ksmbd.service
sudo modprobe -r ksmbd
echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf