# CVE-2026-68099: ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL

> An integer overflow in ksmbd causes malformed ACLs, leading to out-of-bounds reads and potential denial of service or information disclosure.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 10 Aug 2026
- **Updated:** 23 Aug 2026
- **Also known as:** BELL-CVE-2026-68099, DEBIAN-CVE-2026-68099, GHSA-xjwm-2vhv-89mg, UBUNTU-CVE-2026-68099

## What is CVE-2026-68099?

CVE-2026-68099 is a vulnerability in Linux, published on 10 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL

check_add_overflow() unconditionally writes the truncated sum into *d
even on overflow, per its contract in include/linux/overflow.h.
The four check_add_overflow() guards in set_posix_acl_entries_dacl()
and set_ntacl_dacl() break out of the ACE-building loops on overflow,
but the truncated *size is then consumed downstream at the end of
set_ntacl_dacl():

    pndacl->size = cpu_to_le16(le16_to_cpu(pndacl->size) + size);

This produces an on-wire NT ACL whose pndacl->size under-reports the
bytes actually written by the preceding fill_ace_for_sid()/memcpy()
calls, yielding a malformed ACL that can trigger out-of-bounds reads
when re-parsed by clients or ksmbd itself.

Restore *size to its pre-addition value on each overflow branch (via
`*size -= ace_sz` / `size -= nt_ace_size`) so that after the break,
*size once again holds the cumulative size of the successfully-written
ACEs. The committed ACL is then truncated-but-self-consistent rather
than malformed.

The ksmbd DACL builders are the only check_add_overflow() sites found
where an overflow path breaks out of a loop and the destination value
is consumed afterward. The other nearby break-style cases either
return -EINVAL on overflow (transport_ipc.c) or break without
consuming the overflowed destination value afterward (buildid.c).

## Which versions are affected by CVE-2026-68099?


## How do I fix CVE-2026-68099?

Apply the vendor's patch.

## Is CVE-2026-68099 being exploited?

There is no known exploitation of CVE-2026-68099 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-68099 and fix it if it is affected.

What it is: CVE-2026-68099 is a vulnerability in Linux, published on 10 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-68099 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-68099/ (Markdown: https://insights.sbomify.com/CVE-2026-68099/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-68099
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-68099
- OSV: https://osv.dev/vulnerability/CVE-2026-68099

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-68099/
Summaries are generated and may contain mistakes; the official description above is the record.