CVE-2026-68098

A flaw was found in ksmbd, a Linux kernel module. The set_ntacl_dacl() function, which processes Discretionary Access Control Lists (DACLs), can stop copying Access Control Entries (ACEs) prematurely due to a size accounting overflow. This can cause a subsequent deduplication process to read beyond the intended memory buffer, potentially leading to an out-of-bounds read. This issue could result in a denial of service or information disclosure.

This issue affects ksmbd (in-kernel SMB server). DACL dedup walks past copied ACEs when size accounting truncates the output DACL, causing OOB read of buffer tail. Requires ksmbd with NT ACL handling.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.