CVE-2026-68100 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
set_ntacl_dacl() copies each ACE from the attacker-controlled stored security descriptor verbatim into the response DACL without checking sid.num_subauth. The ACE bytes (including an unchecked num_subauth) originate from an authenticated SMB2_SET_INFO(SecInfo=DACL) that is stored raw via ksmbd_vfs_set_sd_xattr(); parse_dacl() rejects a bad ACE with `break` rather than an error, so parse_sec_desc() still returns success and the malformed SD reaches the xattr intact.
On a subsequent SMB2_QUERY_INFO(SecInfo=DACL) for an inode carrying a POSIX access ACL, build_sec_desc() -> set_ntacl_dacl() -> set_posix_acl_entries_dacl() walks the copied ACEs and reads
ntace->sid.sub_auth[ntace->sid.num_subauth - 1]
with num_subauth taken straight from the stored SD. Since sub_auth[]
is fixed at SID_MAX_SUB_AUTHORITIES (15), a crafted num_subauth (e.g. 255) drives an out-of-bounds heap read of ~1 KB with an offset fully controlled by an authenticated client.
The sibling functions already gate this field: parse_dacl() -- num_subauth == 0 || > SID_MAX_SUB_AUTHORITIES parse_sid() -- num_subauth > SID_MAX_SUB_AUTHORITIES smb_copy_sid() -- min_t(u8, num_subauth, SID_MAX_SUB_AUTHORITIES) set_ntacl_dacl() is the lone inconsistent path that omits the check.
Add the same num_subauth validation in set_ntacl_dacl() before copying the ACE, matching the gate already enforced by parse_dacl().
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability resides within the ksmbd kernel module which implements smb2 server functionality for linux systems. This particular flaw manifests when processing security descriptor information through SMB2_SET_INFO and SMB2_QUERY_INFO operations. The core issue stems from insufficient validation of the num_subauth field during ACE (Access Control Entry) processing, creating a potential out-of-bounds memory read condition that can be exploited by authenticated attackers.
The technical flaw occurs in the set_ntacl_dacl() function where ACE data is copied directly from attacker-controlled security descriptors without proper validation of the sid.num_subauth parameter. This function operates as part of the security descriptor processing pipeline where parse_dacl() function normally validates this field by rejecting entries with num_subauth values equal to zero or exceeding SID_MAX_SUB_AUTHORITIES (15). However, set_ntacl_dacl() bypasses this validation and simply copies the malicious ACE data verbatim into the response DACL. The stored security descriptor subsequently gets processed during SMB2_QUERY_INFO operations when build_sec_desc() calls set_ntacl_dacl() followed by set_posix_acl_entries_dacl(), leading to an out-of-bounds heap read.
The operational impact of this vulnerability is significant as it allows authenticated remote attackers to perform controlled out-of-bounds memory reads that can potentially expose sensitive kernel memory contents. The attacker controls the offset of the memory read through the crafted num_subauth value, which when set to values like 255 can result in approximately 1KB of heap memory being read with full control over the access pattern. This type of vulnerability falls under CWE-129 Input Validation and is categorized as an out-of-bounds read condition that can lead to information disclosure or potentially further exploitation depending on what kernel memory is accessed.
The vulnerability directly relates to ATT&CK technique T1059 Command and Scripting Interpreter where attackers could potentially leverage such memory disclosure capabilities to gather system information or identify potential subsequent attack vectors. The inconsistency in validation logic across sibling functions demonstrates a code quality issue where parse_dacl() already enforces proper bounds checking through its conditional validation of num_subauth values, while set_ntacl_dacl() lacks this crucial security measure. This creates an attack surface that allows malicious actors to bypass existing protective mechanisms by targeting the single inconsistent function path.
The recommended mitigation strategy involves implementing identical num_subauth validation in set_ntacl_dacl() before copying ACE data, matching the validation pattern already established in parse_dacl(). This approach aligns with defensive programming practices and follows the principle of least privilege by ensuring all data paths maintain consistent security boundaries. The fix should validate that num_subauth values are within acceptable bounds or apply the same sanitization mechanism used in smb_copy_sid() to prevent malicious values from propagating through the system. This remediation restores consistency across the codebase and prevents attackers from exploiting the inconsistent validation logic to gain unauthorized memory access.