CVE-2026-68099

CVE CVE-2026-68099EUVD EUVD-2026-55480Published 2026-08-10T11:58:13.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL check_add_overflow() unconditionally writes the truncated sum into *d even on overflow, per its contract in include/linux/overflow.h. The four check_add_overflow() guards in set_posix_acl_entries_dacl() and set_ntacl_dacl() break out of the ACE-building loops on overflow, but the truncated *size is then consumed downstream at the end of set_ntacl_dacl(): pndacl->size = cpu_to_le16(le16_to_cpu(pndacl->size) + size); This produces an on-wire NT ACL whose pndacl->size under-reports the bytes actually written by the preceding fill_ace_for_sid()/memcpy() calls, yielding a malformed ACL that can trigger out-of-bounds reads when re-parsed by clients or ksmbd itself. Restore *size to its pre-addition value on each overflow branch (via `*size -= ace_sz` / `size -= nt_ace_size`) so that after the break, *size once again holds the cumulative size of the successfully-written ACEs. The committed ACL is then truncated-but-self-consistent rather than malformed. The ksmbd DACL builders are the only check_add_overflow() sites found where an overflow path breaks out of a loop and the destination value is consumed afterward. The other nearby break-style cases either return -EINVAL on overflow (transport_ipc.c) or break without consuming the overflowed destination value afterward (buildid.c).

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux e1955a94b6f17f4b058afa955a6f187eb3ed7615 <0bf38372821b1526f31538a7d9811844c55c7f38; 6.18.25 <6.18.42; patch: 6.6.148; patch: 7.1.6; patch: 6.18.42; ef7902be3f215b6bf7babe4dc9dd9a7d57dad7a7; 6.12.84 <6.12.101; patch: 7.2-rc5; patch: 6.12.101; 6.6.136 <6.6.148; 6.1.175 <6.2; 299f962c0b02d048fb45d248b4da493d03f3175d <bbf0a8e931204ecdab494a88d43b0a24a04285c5; 7.0.2 <7.1; 5e7b8f3c539d69b2ed5f2408e2f75e68ce7eef43 <847ecd4eb3c117c3d2f13f1e7ab506543aad8183; 8d5729350b236896f51379588d9a690b7fafb8db <f4fcd0c1a243d449307b887fafee23921e9db5ab; 41e53a773db6342ac9a689ee5ba635c31744c9f0; patch: 0; 299f962c0b02d048fb45d248b4da493d03f3175d <bc90144ce8bb7fcf05ad9417c7adb4e9509d9e13; 7.1

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.