CVE-2026-68100

CVE-2026-68100 is a bounds-check bypass in ksmbd's ACL handling that allows a heap leak of approximately 1KB per query. The vulnerability lives in set_ntacl_dacl(), which copies ACEs from a security descriptor into xattrs without validating the num_subauth field in SIDs. This field specifies how many subauthorities a SID contains, and an attacker can set it to a value exceeding the allocated buffer, causing an out-of-bounds read when the kernel later parses the stored descriptor. What makes this CVE notable is the code-pattern failure it exposes. Three sibling functions in the same ksmbd subsystem already enforce this check: parse_dacl() validates num_subauth limits, parse_sid() enforces its own bounds check, and smb_copy_sid() caps the value. set_ntacl_dacl() handles the same security-descriptor data but omits the validation entirely. This isn't a case of developers not knowing the check was necessary — the knowledge was already codified in the codebase. The failure is that the new function was written in isolation without inheriting the validation pattern, and neither automated tooling nor review caught the divergence. Compounding the problem is parse_dacl()'s error-handling design. When encountering a malformed ACE, it uses `break` to continue processing rather than returning an error. This leniency was likely a forward-compatibility choice —

Reviewed through automated stages and approved by a human before publication.