CVE-2026-68098

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: bound DACL dedup walk to copied ACEs<br /> <br /> set_ntacl_dacl() can stop copying ACEs before consuming the full input<br /> DACL when size accounting overflows.<br /> <br /> When that happens, num_aces reflects only the ACEs that were actually<br /> copied into the output DACL, but set_posix_acl_entries_dacl() still<br /> receives nt_num_aces and uses it to walk the existing ACE array during<br /> dedup.<br /> <br /> That makes the dedup walk scan past the copied ACE array and inspect<br /> buffer tail that does not contain valid ACEs.<br /> <br /> Split the two meanings currently carried by the NT ACE count. Pass the<br /> number of copied NT ACEs to bound the dedup walk, and preserve the<br /> original "input DACL had NT ACEs" state separately for the<br /> Everyone/default ACL fallback.<br /> <br /> This keeps the dedup walk aligned with the ACEs that are actually<br /> present in the rebuilt DACL.