{"cve":"CVE-2026-68097","nvd":{"published":"2026-08-10T13:19:54.047","modified":"2026-10-03T11:17:35.613","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate ACE size against SID sub-authorities\n\nset_ntacl_dacl() validates sid.num_subauth before copying an ACE, but\ndoes not verify that the declared ACE size contains all sub-authorities\ndescribed by that field. An undersized ACE can therefore be copied\nand later make the POSIX ACL deduplication walk inspect data beyond\nthe copied ACE boundary.\n\nThe existing initial bound check is also too small. It only ensures\nthat the ACE size field is accessible before set_ntacl_dacl() reads\nsid.num_subauth farther into the input buffer.\n\nRequire enough input for the fixed SID header before accessing\nnum_subauth, reject ACEs smaller than that header, and skip ACEs\nwhose declared size cannot contain the complete SID. This makes the\nvalidation consistent with the other ACE walk paths.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":[],"references":["https://git.kernel.org/stable/c/337022d9dfac441c3b35e4455a51aa981996e02e","https://git.kernel.org/stable/c/5152c6d49e3fd4e9f2e857c57527aead752f1f87","https://git.kernel.org/stable/c/5a2d9fe0e87c71baa0aaa1cfc1361892fcd1ece0","https://git.kernel.org/stable/c/61fd3559199f7fa693dcbff35e59477e24af041a","https://git.kernel.org/stable/c/62d80d7c2d9428085e7458ad4c06ca8c0984039b"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:47:54.990491175+00:00"},"epss":{"cve":"CVE-2026-68097","score":0.00447,"percentile":0.38646,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}