CVE-2026-68100

What it actually does

This is a Linux kernel ksmbd memory-corruption flaw in the SMB server security-descriptor handling path. An authenticated SMB client can store a malformed discretionary access control list (DACL) through SMB2_SET_INFO where a SID contains an invalid num_subauth value greater than the fixed SID_MAX_SUB_AUTHORITIES limit. The malformed descriptor can be persisted as an extended attribute because one parsing path stops processing instead of failing the request. Later, when the same object is queried with SMB2_QUERY_INFO for DACL information and the inode has a POSIX access ACL, ksmbd copies and walks the malformed ACE without validating num_subauth, causing an out-of-bounds heap read in kernel context. The most direct impact is kernel memory disclosure in an SMB response or kernel instability; because the read occurs in kernel memory, sensitive adjacent heap contents may be exposed depending on allocator state and build/configuration.

Why it matters to the business

Systems using the in-kernel ksmbd SMB server may allow any authenticated SMB user with permission to set file security information to trigger kernel memory exposure and potentially service instability. For file servers, NAS appliances, embedded Linux products, and appliances that enable ksmbd, this can undermine confidentiality of data processed by the kernel and disrupt file-sharing operations. The issue is newly published, not listed in CISA KEV, and no public exploit maturity is indicated, but it affects a network-facing service path and should be prioritized where ksmbd is enabled for untrusted or broadly provisioned SMB users.

How an attack unfolds

An attacker first obtains valid SMB credentials for a server running Linux ksmbd. They send an SMB2_SET_INFO request for security information, specifically setting a DACL that contains a crafted ACE with a SID num_subauth value larger than the allowed maximum. Due to inconsistent validation, the malformed security descriptor can be stored raw as metadata on the target file or directory. The attacker then causes ksmbd to rebuild and return security descriptor information for that object, commonly by issuing SMB2_QUERY_INFO for DACL information against an inode that also carries a POSIX access ACL. During response construction, ksmbd reads past the fixed SID sub_auth array using the attacker-controlled num_subauth value, which can expose adjacent kernel heap memory or cause a kernel fault depending on memory layout and hardening.

How to fix it

Apply a Linux kernel update from the operating system or appliance vendor that includes the ksmbd fix validating num_subauth before copying ACEs in set_ntacl_dacl(). If exact fixed package versions are not yet available for a distribution, track vendor advisories for the backport of the upstream patch titled along the lines of "ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl". As an interim mitigation, disable ksmbd if it is not required, unload or blacklist the ksmbd module where operationally feasible, or replace exposure with a patched user-space SMB implementation. Restrict TCP/445 access to trusted networks, reduce SMB write/security-descriptor modification permissions, and avoid granting untrusted users the ability to set file ACLs on ksmbd-backed shares until patched.

How to confirm the fix worked

Confirm whether the system uses ksmbd by checking for the ksmbd kernel module, ksmbd processes/threads, listening SMB service configuration, and vendor appliance documentation. Validate remediation by confirming the running kernel package includes the vendor fix, not merely that an updated kernel is installed but not booted. Where source or build metadata is available, verify the set_ntacl_dacl() path rejects SID num_subauth values of 0 or greater than SID_MAX_SUB_AUTHORITIES before copying ACE data. Confirm ksmbd is not loaded or not listening on TCP/445 if mitigation is to disable it. In controlled test environments only, attempt to set a malformed DACL through SMB and verify the server rejects it cleanly without persisting malformed security-descriptor metadata and without kernel warnings, crashes, or abnormal SMB responses.

Typical attack path

1. Identify a reachable SMB service backed by the Linux in-kernel ksmbd server rather than Samba user-space smbd.
2. Authenticate to the SMB service with an account allowed to access and modify file security information.
3. Create or select a file or directory where the attacker can set security descriptors and where POSIX ACL handling is applicable.
4. Send SMB2_SET_INFO with SecurityInfo including a malformed DACL ACE whose SID num_subauth exceeds SID_MAX_SUB_AUTHORITIES, such as a very large u8 value.
5. Ensure the malformed security descriptor is persisted as object metadata by ksmbd.
6. Send SMB2_QUERY_INFO requesting DACL/security information for the same object.
7. Receive a response that may contain data derived from an out-of-bounds kernel heap read, or trigger a kernel warning/oops if memory safety instrumentation or fault conditions are present.

How to detect it

Look for evidence in three places: SMB telemetry, kernel logs, and file metadata changes. In SMB/network telemetry, investigate authenticated clients that issue SMB2_SET_INFO requests for security descriptors or DACLs followed shortly by SMB2_QUERY_INFO requests for DACL/security information against the same file or directory, especially if the pattern is repeated across many objects or followed by disconnects. Packet captures or SMB-aware IDS logs may show malformed SID structures where the SID sub-authority count is 0 or greater than 15, with values such as 255 being highly suspicious. In host telemetry, review dmesg, journalctl, syslog, crash dumps, pstore, and kernel oops records for ksmbd faults, KASAN/KFENCE reports, or traces through set_ntacl_dacl(), set_posix_acl_entries_dacl(), build_sec_desc(), parse_dacl(), or SMB2_QUERY_INFO handling. In filesystem forensic review, focus on recently modified security-descriptor extended attributes on ksmbd-served paths, especially objects modified by the same account that later triggered DACL queries. Absence of logs does not rule out exploitation because successful out-of-bounds reads may not crash the kernel and typical SMB logs may not decode malformed DACL internals.

• ksmbd
• set_ntacl_dacl
• set_posix_acl_entries_dacl
• build_sec_desc
• parse_dacl
• SMB2_SET_INFO
• SMB2_QUERY_INFO
• SecInfo=DACL
• SecurityInfo=DACL
• num_subauth=255
• SID_MAX_SUB_AUTHORITIES
• BUG: KASAN: slab-out-of-bounds
• KASAN: slab-out-of-bounds
• kernel BUG at fs/smb/server
• Oops:
• ksmbd_vfs_set_sd_xattr

What your security team should do

• Inventory Linux file servers, NAS devices, embedded appliances, and kernels with ksmbd enabled or the ksmbd module available.
• Prioritize patching internet-facing or broadly accessible SMB servers and any environments where many users can authenticate and modify file ACLs.
• If immediate patching is not possible, disable ksmbd or restrict SMB access to trusted management and user networks only.
• Review SMB permissions and remove unnecessary rights to set security descriptors or modify ACLs on shared paths.
• Monitor for unusual sequences of SMB2_SET_INFO security descriptor updates followed by SMB2_QUERY_INFO DACL requests from the same authenticated client.
• Collect and review kernel logs for ksmbd crashes, KASAN slab out-of-bounds reports, oops traces, or stack traces involving set_ntacl_dacl and set_posix_acl_entries_dacl.
• Coordinate with appliance and distribution vendors because fixes may be delivered as backported kernel packages rather than obvious upstream version changes.