CVE-2026-68098

What it actually does

This vulnerability is a Linux kernel ksmbd memory-safety flaw in SMB server ACL handling. When ksmbd rebuilds an NT security descriptor DACL, integer/size accounting can cause ACE copying to stop early while later deduplication logic still walks the original ACE count rather than the number of ACEs actually copied. A crafted ACL can therefore make kernel code read past the valid copied ACE array into adjacent buffer tail data that does not contain valid ACE structures. Depending on kernel build, memory layout, and hardening, the most likely outcomes are kernel memory disclosure, malformed ACL processing, or denial of service through kernel fault/panic in systems exposing ksmbd SMB file sharing.

Why it matters to the business

Organizations using Linux kernel ksmbd for SMB file sharing could experience file-sharing outages, kernel crashes, or exposure of sensitive kernel-adjacent memory during ACL processing. Because SMB services are often used for business-critical file access, exploitation could interrupt user access to shared storage and may create confidentiality risk around filesystem metadata or in-memory data. The issue was published recently and is not listed in CISA KEV and has no known mature public exploitation at this time, but internet- or broadly network-exposed SMB services should still be treated as higher priority due to SMB’s history as a common lateral-movement and remote attack surface.

How an attack unfolds

An attacker first needs network reachability to an SMB service implemented by Linux ksmbd and enough protocol access to submit or manipulate security descriptors containing discretionary ACLs. The attacker then sends a specially crafted ACL/DACL where size accounting causes ksmbd to copy fewer ACE entries than were present in the input. During subsequent POSIX ACL conversion and duplicate-entry handling, vulnerable kernels may iterate using the original NT ACE count instead of the copied ACE count, causing the kernel to inspect memory beyond the valid ACE array. The practical result may be a kernel crash, incorrect ACL handling, or potential leakage/use of unintended memory contents. There is no confirmed public exploit maturity in the supplied data, so exploitation details may remain implementation- and configuration-dependent.

How to fix it

Upgrade to a Linux kernel version containing the ksmbd fix that bounds the DACL deduplication walk to the number of ACEs actually copied. Because no exact affected or fixed package versions were provided, use the fixed kernel packages from the relevant Linux distribution or vendor advisory and confirm that the ksmbd patch for "bound DACL dedup walk to copied ACEs" is included. If immediate patching is not possible, disable ksmbd if it is not required, replace it temporarily with a patched user-space SMB implementation where appropriate, restrict SMB access to trusted networks/VPNs, block TCP/445 from untrusted networks, and limit who can set or modify ACLs on SMB shares.

How to confirm the fix worked

Confirm exposure by checking whether the host runs the in-kernel ksmbd SMB server and whether TCP/445 is reachable from untrusted networks. Validate remediation by confirming the running kernel version matches a vendor-fixed build or by verifying the ksmbd source/package includes the change that passes the copied NT ACE count into the DACL deduplication path. After patching, reboot into the fixed kernel where required and verify the running kernel, not just the installed package, is updated. Functional validation should include SMB share access and ACL modification tests to ensure normal permission handling still works. Mitigation validation should confirm ksmbd is stopped/disabled where intended and that network controls block SMB access from unauthorized sources.

Typical attack path

1. Identify a Linux host exposing SMB file sharing backed by the in-kernel ksmbd service.
2. Authenticate or otherwise reach an SMB operation path that accepts or processes NT security descriptors and DACLs.
3. Submit a crafted security descriptor containing a DACL with ACE sizing/count characteristics that trigger early ACE-copy termination.
4. Cause ksmbd ACL conversion/deduplication to walk beyond the copied ACE array.
5. Observe the result, such as SMB service instability, kernel crash, malformed ACL behavior, or potential memory disclosure effects.

How to detect it

To assess prior exploitation, review Linux kernel logs, system journal entries, crash dumps, and SMB service telemetry around the time of suspicious SMB activity. Focus on hosts running ksmbd and look for kernel oops/panic events, slab or bounds-checking warnings, general protection faults, KASAN reports, or unexpected ksmbd worker crashes that coincide with SMB operations involving security descriptors, ACL changes, file creation, or permission modification. Network logs may show repeated SMB2/SMB3 requests to TCP/445 from the same source followed by service resets or host reboots, but the supplied vulnerability data does not provide a unique wire signature. If kernel crash dumps are available, inspect stack traces for ksmbd ACL conversion functions such as set_ntacl_dacl or set_posix_acl_entries_dacl. Treat unexplained ksmbd-related kernel faults following ACL-heavy SMB activity as suspicious and preserve packet captures, journal logs, and vmcore artifacts for analysis.

• ksmbd
• set_ntacl_dacl
• set_posix_acl_entries_dacl
• kernel: BUG:
• kernel: Oops:
• kernel: general protection fault
• kernel: KASAN:
• kernel panic
• TCP/445
• /sys/module/ksmbd
• /proc/fs/ksmbd
• ksmbd.mountd

What your security team should do

• Inventory Linux systems exposing SMB via ksmbd, prioritizing internet-facing hosts and file servers reachable from large internal network segments.
• Apply vendor-fixed kernel updates as soon as available and reboot systems into the fixed kernel.
• If patching is delayed, disable ksmbd or restrict TCP/445 access to trusted administrative and client networks only.
• Review SMB authentication and authorization controls; minimize accounts allowed to create files or modify ACLs on ksmbd-backed shares.
• Monitor kernel logs and SMB service telemetry for crashes, oops messages, or abnormal ACL/security-descriptor operations.
• Add this issue to vulnerability management tracking even though it is not currently KEV-listed and has no known mature exploitation in the provided data.