CVE-2026-68099 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
check_add_overflow() unconditionally writes the truncated sum into *d even on overflow, per its contract in include/linux/overflow.h. The four check_add_overflow() guards in set_posix_acl_entries_dacl() and set_ntacl_dacl() break out of the ACE-building loops on overflow, but the truncated *size is then consumed downstream at the end of set_ntacl_dacl():
pndacl->size = cpu_to_le16(le16_to_cpu(pndacl->size) + size);
This produces an on-wire NT ACL whose pndacl->size under-reports the bytes actually written by the preceding fill_ace_for_sid()/memcpy() calls, yielding a malformed ACL that can trigger out-of-bounds reads when re-parsed by clients or ksmbd itself.
Restore *size to its pre-addition value on each overflow branch (via `*size -= ace_sz` / `size -= nt_ace_size`) so that after the break, *size once again holds the cumulative size of the successfully-written ACEs. The committed ACL is then truncated-but-self-consistent rather than malformed.
The ksmbd DACL builders are the only check_add_overflow() sites found where an overflow path breaks out of a loop and the destination value is consumed afterward. The other nearby break-style cases either return -EINVAL on overflow (transport_ipc.c) or break without consuming the overflowed destination value afterward (buildid.c).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability resides within the linux kernel's ksmbd implementation where improper handling of access control list size calculations leads to malformed acl structures. This issue specifically affects the nt acl building functions set_posix_acl_entries_dacl() and set_ntacl_dacl() which process access control entries for smb shares. The problem stems from how check_add_overflow() function operates within these contexts, particularly when dealing with cumulative size calculations during ace construction.
The technical flaw manifests in the unchecked overflow handling mechanism where check_add_overflow() performs its arithmetic operation and unconditionally writes the truncated result to the destination pointer regardless of whether overflow occurred. This behavior violates the expected contract defined in include/linux/overflow.h which should preserve the original value on overflow conditions. When overflow occurs during ace size accumulation, the code breaks out of the ace-building loop but continues execution with an incorrectly reduced size value.
The operational impact becomes evident when examining how pndacl->size is updated at the end of set_ntacl_dacl() function through the line pndacl->size = cpu_to_le16(le16_to_cpu(pndacl->size) + size). This operation uses the truncated size value that was modified during overflow conditions, resulting in a malformed acl structure where the reported size under-represents the actual bytes written by fill_ace_for_sid() and memcpy() operations. Such malformed structures trigger out-of-bounds reads during re-parsing by either client applications or the ksmbd server itself.
This vulnerability directly relates to CWE-190, Integer Overflow or Wraparound, and CWE-129, Improper Validation of Array Index, as it involves improper size calculations that result in buffer overflows during acl construction. The issue also maps to ATT&CK technique T1059.001 Command and Scripting Interpreter: Python where malformed data structures could be exploited through crafted smb requests. The specific implementation pattern where overflow paths break out of loops and consume the modified destination value represents a unique code smell that differs from other similar cases in the kernel where overflow conditions either return error codes or don't consume the overflowed values afterward.
The recommended mitigation involves restoring the size parameter to its pre-addition value whenever an overflow occurs, using explicit decrement operations such as *size -= ace_sz or size -= nt_ace_size before breaking from the loop. This ensures that the cumulative size value accurately reflects only the successfully written ace entries rather than including the truncated overflow portion. The fix maintains the integrity of the final acl structure while preserving the defensive overflow protection mechanism. This approach transforms what would otherwise be a malformed structure into a truncated but self-consistent one, preventing out-of-bounds access conditions during subsequent parsing operations.