CVE-2026-68100

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl<br /> <br /> set_ntacl_dacl() copies each ACE from the attacker-controlled stored<br /> security descriptor verbatim into the response DACL without checking<br /> sid.num_subauth. The ACE bytes (including an unchecked num_subauth)<br /> originate from an authenticated SMB2_SET_INFO(SecInfo=DACL) that is<br /> stored raw via ksmbd_vfs_set_sd_xattr(); parse_dacl() rejects a bad ACE<br /> with `break` rather than an error, so parse_sec_desc() still returns<br /> success and the malformed SD reaches the xattr intact.<br /> <br /> On a subsequent SMB2_QUERY_INFO(SecInfo=DACL) for an inode carrying a<br /> POSIX access ACL, build_sec_desc() -&gt; set_ntacl_dacl() -&gt;<br /> set_posix_acl_entries_dacl() walks the copied ACEs and reads<br /> <br /> ntace-&gt;sid.sub_auth[ntace-&gt;sid.num_subauth - 1]<br /> <br /> with num_subauth taken straight from the stored SD. Since sub_auth[]<br /> is fixed at SID_MAX_SUB_AUTHORITIES (15), a crafted num_subauth (e.g.<br /> 255) drives an out-of-bounds heap read of ~1 KB with an offset fully<br /> controlled by an authenticated client.<br /> <br /> The sibling functions already gate this field:<br /> parse_dacl() -- num_subauth == 0 || &gt; SID_MAX_SUB_AUTHORITIES<br /> parse_sid() -- num_subauth &gt; SID_MAX_SUB_AUTHORITIES<br /> smb_copy_sid() -- min_t(u8, num_subauth, SID_MAX_SUB_AUTHORITIES)<br /> set_ntacl_dacl() is the lone inconsistent path that omits the check.<br /> <br /> Add the same num_subauth validation in set_ntacl_dacl() before copying<br /> the ACE, matching the gate already enforced by parse_dacl().