# CVE-2026-68100: ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl

> An authenticated attacker can trigger an out-of-bounds heap read in the Linux kernel ksmbd module by sending a crafted SMB request, potentially leaking memory or causing a crash.

- **Severity:** High 8.1 (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 10 Aug 2026
- **Updated:** 19 Oct 2026
- **Also known as:** BELL-CVE-2026-68100, DEBIAN-CVE-2026-68100, GHSA-gx4w-gwrq-p4gh, UBUNTU-CVE-2026-68100

## What is CVE-2026-68100?

CVE-2026-68100 is a high-severity memory corruption vulnerability in Linux, published on 10 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl

set_ntacl_dacl() copies each ACE from the attacker-controlled stored
security descriptor verbatim into the response DACL without checking
sid.num_subauth. The ACE bytes (including an unchecked num_subauth)
originate from an authenticated SMB2_SET_INFO(SecInfo=DACL) that is
stored raw via ksmbd_vfs_set_sd_xattr(); parse_dacl() rejects a bad ACE
with `break` rather than an error, so parse_sec_desc() still returns
success and the malformed SD reaches the xattr intact.

On a subsequent SMB2_QUERY_INFO(SecInfo=DACL) for an inode carrying a
POSIX access ACL, build_sec_desc() -> set_ntacl_dacl() ->
set_posix_acl_entries_dacl() walks the copied ACEs and reads

    ntace->sid.sub_auth[ntace->sid.num_subauth - 1]

with num_subauth taken straight from the stored SD. Since sub_auth[]
is fixed at SID_MAX_SUB_AUTHORITIES (15), a crafted num_subauth (e.g.
255) drives an out-of-bounds heap read of ~1 KB with an offset fully
controlled by an authenticated client.

The sibling functions already gate this field:
  parse_dacl()    -- num_subauth == 0 || > SID_MAX_SUB_AUTHORITIES
  parse_sid()     -- num_subauth > SID_MAX_SUB_AUTHORITIES
  smb_copy_sid()  -- min_t(u8, num_subauth, SID_MAX_SUB_AUTHORITIES)
set_ntacl_dacl() is the lone inconsistent path that omits the check.

Add the same num_subauth validation in set_ntacl_dacl() before copying
the ACE, matching the gate already enforced by parse_dacl().

Weakness: CWE-125 (Out-of-bounds Read)

## Which versions are affected by CVE-2026-68100?


## How do I fix CVE-2026-68100?

Apply the vendor's patch.

## Is CVE-2026-68100 being exploited?

There is no known exploitation of CVE-2026-68100 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-68100 and fix it if it is affected.

What it is: CVE-2026-68100 is a high-severity memory corruption vulnerability in Linux, published on 10 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-68100 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-68100/ (Markdown: https://insights.sbomify.com/CVE-2026-68100/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-68100
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-68100
- OSV: https://osv.dev/vulnerability/CVE-2026-68100

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-68100/
Summaries are generated and may contain mistakes; the official description above is the record.