CVE-2026-68098 Linux CVE debrief

Who should care

System administrators and users of Linux systems should be aware of this vulnerability and take necessary actions to patch their systems. The vulnerability has a high CVSS score of 8.8, indicating a high severity.

Technical summary

The ksmbd module in the Linux kernel had a vulnerability where the DACL dedup walk could scan past the copied ACE array. This happened because set_ntacl_dacl() could stop copying ACEs before consuming the full input DACL when size accounting overflowed. The issue was resolved by differentiating between the number of copied NT ACEs and the original 'input DACL had NT ACEs' state. A high-severity vulnerability has been identified in the Linux kernel, specifically in the ksmbd module, affecting system administrators and users of Linux systems. The vulnerability is related to the handling of DACL (Discretionary Access Control List) dedup walk, which can lead to scanning past the copied ACE (Access Control Entry) array and inspecting buffer tail that does not contain valid ACEs. This issue arises when set_ntacl_dacl() stops copying ACEs before consuming the full input DACL due to size accounting overflow. System administrators and users of Linux systems should be aware of this vulnerability and take necessary actions to patch their systems. The vulnerability has a high CVSS score of 8.8, indicating a high severity. To address this vulnerability, it is essential to apply the necessary patches to the Linux kernel to fix the DACL dedup walk vulnerability. Additionally, assessing exposure and prioritizing patching based on system configurations and potential impact is crucial. Monitoring system logs for potential exploitation attempts can also help in identifying and mitigating the vulnerability. By taking these steps, system administrators can prevent potential attacks and ensure the security of their Linux systems. The vulnerability was resolved by splitting the two meanings carried by the NT ACE count. The number of copied NT ACEs is now passed to bound the dedup walk, and the original 'input DACL had NT ACEs' state is preserved separately for the Everyone/default ACL fallback. This change keeps the dedup walk aligned with the ACEs that are actually present in the rebuilt DACL, preventing the scanning of past the copied ACE array and inspecting buffer tail that does not contain valid ACEs. The fix ensures that the dedup walk is aligned with the ACEs that are actually

Defensive priority

High priority should be given to patching the Linux kernel to prevent potential attacks. System administrators should assess their exposure and apply the necessary patches as soon as possible.

Recommended defensive actions

• Apply the necessary patches to the Linux kernel to fix the DACL dedup walk vulnerability.
• Assess exposure and prioritize patching based on system configurations and potential impact.
• Monitor system logs for potential exploitation attempts.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was resolved by splitting the two meanings carried by the NT ACE count. The number of copied NT ACEs is now passed to bound the dedup walk, and the original 'input DACL had NT ACEs' state is preserved separately for the Everyone/default ACL fallback. This change keeps the dedup walk aligned with the ACEs that are actually present in the rebuilt DACL.

Official resources