CVE-2026-68099

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL<br /> <br /> check_add_overflow() unconditionally writes the truncated sum into *d<br /> even on overflow, per its contract in include/linux/overflow.h.<br /> The four check_add_overflow() guards in set_posix_acl_entries_dacl()<br /> and set_ntacl_dacl() break out of the ACE-building loops on overflow,<br /> but the truncated *size is then consumed downstream at the end of<br /> set_ntacl_dacl():<br /> <br /> pndacl-&gt;size = cpu_to_le16(le16_to_cpu(pndacl-&gt;size) + size);<br /> <br /> This produces an on-wire NT ACL whose pndacl-&gt;size under-reports the<br /> bytes actually written by the preceding fill_ace_for_sid()/memcpy()<br /> calls, yielding a malformed ACL that can trigger out-of-bounds reads<br /> when re-parsed by clients or ksmbd itself.<br /> <br /> Restore *size to its pre-addition value on each overflow branch (via<br /> `*size -= ace_sz` / `size -= nt_ace_size`) so that after the break,<br /> *size once again holds the cumulative size of the successfully-written<br /> ACEs. The committed ACL is then truncated-but-self-consistent rather<br /> than malformed.<br /> <br /> The ksmbd DACL builders are the only check_add_overflow() sites found<br /> where an overflow path breaks out of a loop and the destination value<br /> is consumed afterward. The other nearby break-style cases either<br /> return -EINVAL on overflow (transport_ipc.c) or break without<br /> consuming the overflowed destination value afterward (buildid.c).