CVE-2026-68099

What it actually does

This is a Linux kernel ksmbd flaw in SMB ACL construction. When ksmbd builds NT discretionary ACLs, integer-overflow checks can leave a truncated size value in the ACL structure after the code has already written more ACL entry data than that size reports. The resulting on-wire ACL is internally inconsistent: the recorded DACL size is smaller than the bytes actually emitted. When that malformed ACL is later parsed by an SMB client or by ksmbd itself, parsing logic can read beyond expected ACL boundaries. The most likely technical outcomes are out-of-bounds reads, kernel warnings or crashes, SMB service instability, and possible limited information exposure depending on surrounding memory and parser behavior.

Why it matters to the business

Organizations using the in-kernel Linux SMB server, ksmbd, could experience SMB file-sharing outages or instability if a malformed ACL is generated and re-parsed. File access workflows, shared drives, backup jobs, and applications relying on SMB shares may be disrupted. Because this issue is newly published, has no listed CISA KEV status, is not known to be used in ransomware campaigns, and has no stated public exploit maturity, it should be prioritized based on ksmbd exposure: internet- or broadly reachable SMB servers and systems allowing untrusted users to modify ACLs should be treated as higher risk.

How an attack unfolds

An attacker first needs access to an SMB service backed by the Linux kernel ksmbd server and a way to influence file or directory ACLs, such as through authenticated SMB access with permissions to create, modify, or set security descriptors. The attacker then crafts or accumulates ACL entries large enough to exercise the vulnerable DACL-building paths in ksmbd. When the cumulative ACL size overflows, vulnerable kernels break out of the ACL-entry loop but keep the overflow-truncated size value. ksmbd then commits or sends an ACL whose declared DACL size does not match the actual bytes written. A subsequent request that causes the malformed ACL to be parsed by a client or by ksmbd can trigger out-of-bounds reads, potentially causing SMB client errors, ksmbd instability, kernel crash conditions, or limited disclosure depending on the parsing path.

How to fix it

Apply a Linux kernel update that includes the ksmbd fix restoring the ACL size value after check_add_overflow() detects overflow in the DACL-building paths. No exact fixed package versions were provided in the input, so use the fixed kernel versions published by the relevant Linux distribution or kernel vendor. If ksmbd is not required, disable it and remove SMB exposure. If immediate patching is not possible, reduce risk by restricting TCP/445 access to trusted networks, requiring authentication, limiting who can modify ACLs on SMB shares, disabling or isolating ksmbd-backed shares exposed to untrusted users, and monitoring for SMB service crashes or kernel out-of-bounds-read diagnostics.

How to confirm the fix worked

Confirm exposure by checking whether the system runs the in-kernel ksmbd service/module and whether SMB TCP/445 is reachable. Validate remediation by verifying the installed kernel package includes the vendor fix for this ksmbd DACL overflow-handling issue, rebooting into the fixed kernel, and confirming the running kernel version is the patched one. Where safe and supported, regression-test SMB ACL operations involving large or complex ACLs and confirm they no longer produce malformed security descriptors, client parsing errors, kernel warnings, or ksmbd crashes. Also confirm ksmbd is disabled on systems where SMB service is not required.

Typical attack path

1. Identify a Linux SMB service using ksmbd rather than Samba user-space smbd.
2. Obtain authenticated SMB access or another path that allows influencing file or directory ACLs.
3. Create or modify ACL/security descriptor data with many or unusually large access control entries.
4. Trigger ksmbd to build an NT DACL from the crafted ACL data.
5. Cause the malformed ACL to be returned to a client or re-parsed by ksmbd.
6. Observe service instability, client parsing failures, kernel warnings, crashes, or other out-of-bounds-read side effects.

How to detect it

Look for evidence of prior exploitation or attempted triggering in Linux kernel logs, system journals, SMB service logs, crash dumps, and endpoint telemetry. Focus on ksmbd-enabled systems and correlate SMB ACL/security descriptor operations with kernel warnings, oopses, KASAN reports, general protection faults, unexpected reboots, or ksmbd thread crashes. Useful log sources include journalctl/kern.log/dmesg, distribution crash reporting, netfilter or firewall logs for SMB connections, packet captures or Zeek/Suricata SMB metadata if available, and EDR process/kernel telemetry. Hunt for bursts of SMB requests that set or query security descriptors, create unusually large or complex ACLs, or precede ksmbd instability. There are no unique public exploit strings or payload signatures derivable from the provided advisory; detection should therefore emphasize behavioral correlation between SMB ACL activity and kernel memory-safety failures.

What your security team should do

• Inventory Linux systems exposing SMB and distinguish ksmbd from Samba user-space smbd deployments.
• Prioritize patching ksmbd-enabled servers reachable by untrusted networks or used by untrusted/authenticated users who can modify ACLs.
• Apply vendor kernel updates and reboot into the fixed kernel; kernel package installation alone is not sufficient if the old kernel remains running.
• Disable ksmbd where it is not required, or replace it with a maintained alternative if operationally appropriate.
• Restrict SMB access on TCP/445 to trusted hosts and networks until patching is complete.
• Review SMB share permissions and reduce the ability of low-trust users to create or modify complex ACLs.
• Monitor kernel logs, SMB service health, and endpoint telemetry for crashes, oops messages, KASAN reports, or unusual ACL-heavy SMB activity.
• Because this is not currently listed in CISA KEV and has no stated exploit maturity, use exposure-based prioritization rather than emergency internet-wide assumptions.