CVE-2026-68097

What it actually does

This flaw is in the Linux kernel ksmbd SMB server's handling of NT security descriptors and access control entries. When processing a discretionary ACL, ksmbd validates the SID sub-authority count but did not confirm that the ACE's declared size is large enough to contain all SID sub-authorities. A malformed, undersized ACE can therefore cause later ACL-processing logic to read beyond the copied ACE boundary during POSIX ACL deduplication. The most likely technical outcomes are kernel memory safety violations, kernel warnings or crashes, and possible information exposure depending on allocator layout and build hardening. Exploitability depends on ksmbd being enabled and reachable, and on an attacker being able to send SMB requests that set or modify security descriptors on a share.

Why it matters to the business

Organizations using the in-kernel Linux SMB server may face unexpected file-service outages or kernel instability if a malicious or malformed SMB client sends crafted ACL data. Because SMB file shares are often used for shared storage, backups, application data exchange, and user file access, exploitation could disrupt business operations even if it does not directly lead to data theft. The issue is newly published, not listed in CISA KEV, and has no reported mature public exploit in the supplied data, so urgency is highest for internet-exposed or broadly reachable ksmbd servers and lower for systems where SMB is tightly restricted or ksmbd is not in use.

How an attack unfolds

An attacker first identifies a Linux host running the kernel ksmbd SMB server and confirms that SMB is reachable, typically on TCP port 445. The attacker then authenticates or otherwise reaches functionality that allows setting or updating file or directory security descriptors. They submit a crafted SMB security descriptor containing a DACL with an ACE whose SID reports more sub-authorities than the ACE size can actually contain. Vulnerable ksmbd code reads the sub-authority count and copies the undersized ACE without rejecting the inconsistency. Later, while translating or deduplicating the ACL for POSIX ACL handling, the kernel walks past the copied ACE boundary and inspects adjacent memory. Depending on kernel configuration and memory layout, this can manifest as an SMB service failure, kernel oops, system crash, or other memory-safety side effects. There are no named threat actors or ransomware campaigns associated with the issue in the supplied data.

How to fix it

Upgrade to a Linux kernel version or distribution kernel package that includes the ksmbd fix validating ACE size against SID sub-authorities. Because no exact affected product list or fixed package versions were provided, use vendor advisories and changelogs for the running distribution to identify the first fixed kernel build. After patching, reboot into the fixed kernel and ensure the vulnerable kernel is no longer running. If immediate patching is not possible, reduce exposure by disabling ksmbd where not required, unloading the ksmbd module if safe to do so, blocking SMB access from untrusted networks, restricting TCP/445 to trusted clients through host and network firewalls, and limiting who can modify ACLs on SMB shares. Where feasible, consider using a fully patched SMB implementation and avoid exposing SMB services directly to the internet.

How to confirm the fix worked

Confirm whether ksmbd is in use by checking for the ksmbd kernel module, kernel configuration, and listeners on SMB ports. Validate remediation by verifying that the running kernel, not just the installed package, is a vendor-fixed build containing the ksmbd ACE/SID bounds-checking patch. Review distribution security advisories, kernel changelogs, or package metadata for the specific fix. Reboot if the fixed kernel is installed but not running. Confirm exposure reduction by verifying TCP/445 is not reachable from untrusted networks and that ksmbd is disabled or unloaded where not needed. For higher assurance, use a non-production test system with the fixed kernel and negative-test malformed SMB security descriptors to confirm they are rejected without kernel warnings or crashes.

Typical attack path

1. Find a Linux SMB server that is using the in-kernel ksmbd implementation rather than only a user-space SMB daemon.
2. Establish network connectivity to the SMB service, commonly over TCP/445.
3. Authenticate or obtain access to an SMB operation that can set file or directory security descriptors or ACLs.
4. Send a crafted SMB request containing a DACL ACE with an undersized ACE length and a SID sub-authority count that cannot fit within that length.
5. Trigger ksmbd's NT ACL to POSIX ACL processing path so the malformed ACE is copied and later walked during ACL deduplication.
6. Cause an out-of-bounds kernel memory read condition, potentially resulting in kernel warnings, service disruption, or a system crash.

How to detect it

To assess possible prior exploitation, review Linux kernel logs, system journals, crash dumps, and SMB service telemetry from ksmbd-enabled hosts. Focus on events where SMB security descriptor or ACL modification activity is followed by kernel warnings, KASAN reports, oops messages, general protection faults, unexpected reboots, or ksmbd worker failures. Useful log sources include journalctl/kern.log/messages, dmesg persistence, kdump/vmcore records, audit logs for SMB-related file permission changes, firewall logs for SMB connections, and packet captures or network sensor metadata for SMB2 SET_INFO requests with Security information. In packet captures, look for SMB security descriptor updates containing ACE records where the ACE size is smaller than required for the SID sub-authority count. Correlate suspicious SMB client IPs with authentication logs and file ACL changes around the same time. Because no public exploit indicators, malware artifacts, or named threat actor tooling were supplied, detection should be behavior-based: malformed SMB ACL traffic plus ksmbd kernel memory-safety symptoms.

• ksmbd
• set_ntacl_dacl
• KASAN: slab-out-of-bounds
• KASAN: out-of-bounds
• slab-out-of-bounds in ksmbd
• general protection fault
• BUG: unable to handle kernel
• kernel NULL pointer dereference
• Oops:
• SMB2 SET_INFO
• InfoType: Security
• SecurityDescriptor
• DACL
• /sys/module/ksmbd
• ksmbd.ko
• CONFIG_SMB_SERVER

What your security team should do

• Inventory Linux systems providing SMB services and distinguish ksmbd from user-space SMB implementations.
• Prioritize patching ksmbd-enabled servers that are internet-facing, reachable from broad internal networks, or used for critical file-sharing workloads.
• Upgrade to the vendor-fixed kernel and reboot to ensure the fixed kernel is active.
• If patching is delayed, restrict TCP/445 to trusted networks and disable or unload ksmbd on systems where it is not required.
• Review SMB share permissions and limit ACL modification rights to trusted administrators and service accounts.
• Monitor kernel logs and SMB telemetry for malformed security descriptor activity, ksmbd crashes, KASAN reports, or unexplained reboots.
• Add detection content for SMB security descriptor update attempts followed by ksmbd kernel faults or service interruption.
• Track vendor advisories for exact fixed kernel versions because the supplied data does not include per-package fixed versions.