CVE-2026-68100

A flaw was found in ksmbd in the Linux kernel. An authenticated client can provide a crafted security descriptor that is not properly validated when copying Access Control Entries (ACEs) in the set_ntacl_dacl() function. This improper validation leads to an out-of-bounds heap read, allowing the client to read approximately 1 KB of kernel memory. This could result in the disclosure of sensitive information.

A kernel heap out-of-bounds read in ksmbd can occur because set_ntacl_dacl copies ACE data from a stored security descriptor without validating sid.num_subauth. An authenticated SMB client can first store a malformed DACL with SMB2_SET_INFO and later trigger SMB2_QUERY_INFO for DACL on an inode with a POSIX access ACL, causing set_posix_acl_entries_dacl to read ntace sid sub_auth at an attacker controlled index. For the CVSS the PR:L is used because the attacker needs authenticated SMB access to the ksmbd share, but no local shell or administrator privileges on the victim are required. The issue is network reachable over SMB when ksmbd is exposed to the authenticated client. Impact is at least possible kernel memory disclosure through an out-of-bounds read and possible denial of service if the invalid read hits an unsafe memory boundary or hardened debug checks.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.