CVE-2026-68098

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-68098

Key Details

CVE	CVE-2026-68098
CVSS Score / Version	8.8 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: bound DACL dedup walk to copied ACEs

set_ntacl_dacl() can stop copying ACEs before consuming the full input

DACL when size accounting overflows.

When that happens, num_aces reflects only the ACEs that were actually

copied into the output DACL, but set_posix_acl_entries_dacl() still

receives nt_num_aces and uses it to walk the existing ACE array during

dedup.

That makes the dedup walk scan past the copied ACE array and inspect

buffer tail that does not contain valid ACEs.

Split the two meanings currently carried by the NT ACE count. Pass the

number of copied NT ACEs to bound the dedup walk, and preserve the

original "input DACL had NT ACEs" state separately for the

Everyone/default ACL fallback.

This keeps the dedup walk aligned with the ACEs that are actually

present in the rebuilt DACL. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-68098
CVE	https://www.cve.org/CVERecord?id=CVE-2026-68098

Source

Reference

NVD

CVE