CVE-2026-68097

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: validate ACE size against SID sub-authorities<br /> <br /> set_ntacl_dacl() validates sid.num_subauth before copying an ACE, but<br /> does not verify that the declared ACE size contains all sub-authorities<br /> described by that field. An undersized ACE can therefore be copied<br /> and later make the POSIX ACL deduplication walk inspect data beyond<br /> the copied ACE boundary.<br /> <br /> The existing initial bound check is also too small. It only ensures<br /> that the ACE size field is accessible before set_ntacl_dacl() reads<br /> sid.num_subauth farther into the input buffer.<br /> <br /> Require enough input for the fixed SID header before accessing<br /> num_subauth, reject ACEs smaller than that header, and skip ACEs<br /> whose declared size cannot contain the complete SID. This makes the<br /> validation consistent with the other ACE walk paths.