CVE-2026-68097

CVE-2026-68097 is a bounds-checking ordering failure in ksmbd's set_ntacl_dacl() function. The vulnerability validates sid.num_subauth (which determines how much subsequent data is required) before verifying the ACE buffer is actually large enough to contain those sub-authorities. This is a classic protocol-parsing ordering error—you're checking 'can I interpret this field?' before checking 'does enough data exist to make the field meaningful?' The fix makes validation 'consistent with other ACE walk paths,' which reveals something important: the correct pattern already existed elsewhere in the same file. This wasn't a knowledge gap—the developers knew how to validate ACE sizes. Instead, this is a coordination failure where a code path evolved (likely during ksmbd's parallel development) without following the established pattern. The ACL translation layer sits at the intersection of Windows SMB semantics and POSIX kernel ACLs, and this complexity appears to have created drift between code paths. The CVSS 8.8 is elevated for what is fundamentally a precondition-bound vulnerability: exploitation requires an authenticated SMB session with ACL write capability, then a separate deduplication walk must trigger. However, the real blast radius concern is structural: one malformed ACE doesn't stay isolated—it can corrupt the deduplication walk that enforces ACL consistency for the entire share. The deduplication logic operates on the assumption that ACE data is self-consistent and bounded; violating that invariant affects every file on the mounted share. The EPSS score of 0.00414 is notably low, reflecting the authentication prerequisite and multi-step trigger chain. This vulnerability sits in the 'theoretically severe, practically constrained' category—useful for lateral movement in already-accessed environments rather than mass automation. Audit priority: audit set_ntacl_dacl() and its sibling ACE walk functions for consistent validation patterns. The 'consistent with other paths' fix tells you the pattern exists elsewhere—your job is to verify those reference paths are actually correct under adversarial inputs, not just uniformly wrong. Given ksmbd's relative youth (merged 2021) compared to Samba's two decades of ACL battle-testing, assume latent equivalent bugs exist in other SMB-to-kernel translation paths and prioritize auditing those interfaces.

Reviewed through automated stages and approved by a human before publication.