CVE-2026-68100: Linux Kernel Privilege Escalation Flaw

CVE-2026-68100 Overview

CVE-2026-68100 is an out-of-bounds heap read vulnerability in the Linux kernel's ksmbd SMB server implementation. The flaw resides in set_ntacl_dacl(), which copies Access Control Entries (ACEs) from an attacker-controlled security descriptor without validating the sid.num_subauth field. An authenticated SMB client can store a malformed security descriptor via SMB2_SET_INFO(SecInfo=DACL), then trigger a subsequent SMB2_QUERY_INFO request that reads roughly 1 KB of adjacent heap memory at an attacker-controlled offset.

Critical Impact
Authenticated remote attackers can trigger out-of-bounds heap reads in kernel space, exposing sensitive kernel memory contents or causing denial of service on Linux systems running ksmbd.

Affected Products

Linux Kernel (ksmbd in-kernel SMB3 server)
Distributions shipping vulnerable ksmbd builds prior to the referenced stable commits
Systems exposing SMB shares via ksmbd to authenticated clients

Discovery Timeline

2026-08-10 - CVE-2026-68100 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68100

Vulnerability Analysis

The vulnerability lives in the ksmbd path that builds a response DACL from a stored NT security descriptor. When an inode carries a POSIX access ACL, build_sec_desc() calls set_ntacl_dacl(), which in turn invokes set_posix_acl_entries_dacl(). That helper dereferences ntace->sid.sub_auth[ntace->sid.num_subauth - 1] using the raw num_subauth byte pulled from the stored security descriptor.

The sub_auth[] array is fixed at SID_MAX_SUB_AUTHORITIES (15) entries. Supplying num_subauth = 255 walks the read pointer approximately 1 KB past the end of the SID structure. Because the offset is fully controlled by an authenticated client, adjacent kernel heap contents are returned in the SMB response, enabling information disclosure or triggering a crash on unmapped pages.

Root Cause

Sibling parsers already validate this field. parse_dacl() rejects num_subauth == 0 or values greater than SID_MAX_SUB_AUTHORITIES, parse_sid() bounds the same value, and smb_copy_sid() clamps via min_t(u8, num_subauth, SID_MAX_SUB_AUTHORITIES). However, set_ntacl_dacl() omits this gate entirely. Additionally, parse_dacl() uses break rather than returning an error on a bad ACE, so parse_sec_desc() still reports success and ksmbd_vfs_set_sd_xattr() stores the malformed descriptor to the xattr verbatim [CWE-125].

Attack Vector

An authenticated SMB user first issues SMB2_SET_INFO(SecInfo=DACL) carrying a crafted security descriptor with an inflated num_subauth value. The malformed descriptor is persisted as an extended attribute on the target inode. On any subsequent SMB2_QUERY_INFO(SecInfo=DACL) against that inode, the kernel reads out-of-bounds heap memory and returns it inside the DACL response. Exploitation requires only valid SMB credentials and write access to a share exposed by ksmbd.

No verified public exploitation code is available. See the Linux Kernel commit for the authoritative fix.

Detection Methods for CVE-2026-68100

Indicators of Compromise

Anomalous SMB2_SET_INFO requests targeting DACL security information with oversized SID sub-authority counts
Kernel log entries from ksmbd referencing security descriptor parsing or ACL handling errors
Repeated SMB2_QUERY_INFO(SecInfo=DACL) requests immediately following SMB2_SET_INFO operations from the same session

Detection Strategies

Inspect SMB2 traffic for security descriptors where any SID's num_subauth field exceeds 15 (SID_MAX_SUB_AUTHORITIES)
Alert on ksmbd worker processes producing unusually large DACL response payloads relative to file metadata size
Correlate authenticated SMB sessions performing DACL writes on files that also carry POSIX ACLs

Monitoring Recommendations

Enable kernel audit logging on ksmbd modules and monitor for KASAN or slab out-of-bounds reports on production kernels where instrumentation is available
Track authenticated SMB user activity for unusual patterns of SecInfo=DACL set/query pairs
Capture and retain SMB packet metadata to support post-incident analysis of security descriptor content

How to Mitigate CVE-2026-68100

Immediate Actions Required

Update to a Linux kernel version that includes the upstream fix adding num_subauth validation in set_ntacl_dacl()
Restrict ksmbd share access to trusted authenticated users only, and disable guest and anonymous access
Where patching is delayed, disable the ksmbd module and route SMB workloads through userspace Samba until fixed kernels are deployed

Patch Information

The fix adds the same num_subauth bounds check already enforced by parse_dacl() before copying each ACE. Stable kernel commits providing the resolution include 47f0b34f6bc9, 5acbd3012fd4, b6d3cc6a5244, e31fada51437, and fb3dc8e6da46. Apply the vendor kernel update from your distribution as soon as it is available.

Workarounds

Unload the ksmbd kernel module (modprobe -r ksmbd) and prevent auto-load until patches are applied
Block inbound TCP/445 at the network perimeter and restrict SMB share membership to a minimal set of authenticated users
Remove write permissions on shares that expose files carrying POSIX access ACLs to reduce reachability of the vulnerable code path

bash

# Disable and blacklist the ksmbd module until a patched kernel is deployed
sudo systemctl stop ksmbd.service
sudo modprobe -r ksmbd
echo "blacklist ksmbd" | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf

# Verify the module is not loaded
lsmod | grep ksmbd