{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-68099 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-68099 is a vulnerability in Linux, published on 10 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-68099 and fix it if it is affected.\n\nWhat it is: CVE-2026-68099 is a vulnerability in Linux, published on 10 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-68099 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-68099/ (Markdown: https://insights.sbomify.com/CVE-2026-68099/index.md)","id":"CVE-2026-68099","markdown":"https://insights.sbomify.com/CVE-2026-68099/index.md","name":"CVE-2026-68099","record":{"aliases":["BELL-CVE-2026-68099","DEBIAN-CVE-2026-68099","GHSA-xjwm-2vhv-89mg","UBUNTU-CVE-2026-68099"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service","data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel SMB","requires_auth":"low_privilege","summary":"An integer overflow in ksmbd causes malformed ACLs, leading to out-of-bounds reads and potential denial of service or information disclosure.","user_interaction":"not_required","vuln_class":"integer_overflow"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL\n\ncheck_add_overflow() unconditionally writes the truncated sum into *d\neven on overflow, per its contract in include/linux/overflow.h.\nThe four check_add_overflow() guards in set_posix_acl_entries_dacl()\nand set_ntacl_dacl() break out of the ACE-building loops on overflow,\nbut the truncated *size is then consumed downstream at the end of\nset_ntacl_dacl():\n\n    pndacl-\u003esize = cpu_to_le16(le16_to_cpu(pndacl-\u003esize) + size);\n\nThis produces an on-wire NT ACL whose pndacl-\u003esize under-reports the\nbytes actually written by the preceding fill_ace_for_sid()/memcpy()\ncalls, yielding a malformed ACL that can trigger out-of-bounds reads\nwhen re-parsed by clients or ksmbd itself.\n\nRestore *size to its pre-addition value on each overflow branch (via\n`*size -= ace_sz` / `size -= nt_ace_size`) so that after the break,\n*size once again holds the cumulative size of the successfully-written\nACEs. The committed ACL is then truncated-but-self-consistent rather\nthan malformed.\n\nThe ksmbd DACL builders are the only check_add_overflow() sites found\nwhere an overflow path breaks out of a loop and the destination value\nis consumed afterward. The other nearby break-style cases either\nreturn -EINVAL on overflow (transport_ipc.c) or break without\nconsuming the overflowed destination value afterward (buildid.c).","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL","id":"CVE-2026-68099","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"integer_overflow","year":"2026"},"n_packages":0,"n_references":6,"next":{"headline":"ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl","id":"CVE-2026-68100"},"packages":[],"prev":{"headline":"ksmbd: bound DACL dedup walk to copied ACEs","id":"CVE-2026-68098"},"products":["Linux"],"published":"2026-08-10","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-23","vendors":["Linux"]},"summary":"An integer overflow in ksmbd causes malformed ACLs, leading to out-of-bounds reads and potential denial of service or information disclosure.","url":"https://insights.sbomify.com/CVE-2026-68099/"}