{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-68099",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-68099",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-08-10T11:58:13.940Z",
    "updatedAt": "2026-08-23T12:45:49.075Z",
    "importedAt": "2026-10-24T01:58:25.636Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL\n\ncheck_add_overflow() unconditionally writes the truncated sum into *d\neven on overflow, per its contract in include/linux/overflow.h.\nThe four check_add_overflow() guards in set_posix_acl_entries_dacl()\nand set_ntacl_dacl() break out of the ACE-building loops on overflow,\nbut the truncated *size is then consumed downstream at the end of\nset_ntacl_dacl():\n\n    pndacl->size = cpu_to_le16(le16_to_cpu(pndacl->size) + size);\n\nThis produces an on-wire NT ACL whose pndacl->size under-reports the\nbytes actually written by the preceding fill_ace_for_sid()/memcpy()\ncalls, yielding a malformed ACL that can trigger out-of-bounds reads\nwhen re-parsed by clients or ksmbd itself.\n\nRestore *size to its pre-addition value on each overflow branch (via\n`*size -= ace_sz` / `size -= nt_ace_size`) so that after the break,\n*size once again holds the cumulative size of the successfully-written\nACEs. The committed ACL is then truncated-but-self-consistent rather\nthan malformed.\n\nThe ksmbd DACL builders are the only check_add_overflow() sites found\nwhere an overflow path breaks out of a loop and the destination value\nis consumed afterward. The other nearby break-style cases either\nreturn -EINVAL on overflow (transport_ipc.c) or break without\nconsuming the overflowed destination value afterward (buildid.c).",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "41e53a773db6342ac9a689ee5ba635c31744c9f0",
              "status": "affected",
              "versionType": "git",
              "lessThan": "8f3a7a499a7d9bb1c0f33fe78c4a4594d7e307f4"
            },
            {
              "version": "8d5729350b236896f51379588d9a690b7fafb8db",
              "status": "affected",
              "versionType": "git",
              "lessThan": "f4fcd0c1a243d449307b887fafee23921e9db5ab"
            },
            {
              "version": "e1955a94b6f17f4b058afa955a6f187eb3ed7615",
              "status": "affected",
              "versionType": "git",
              "lessThan": "0bf38372821b1526f31538a7d9811844c55c7f38"
            },
            {
              "version": "5e7b8f3c539d69b2ed5f2408e2f75e68ce7eef43",
              "status": "affected",
              "versionType": "git",
              "lessThan": "847ecd4eb3c117c3d2f13f1e7ab506543aad8183"
            },
            {
              "version": "299f962c0b02d048fb45d248b4da493d03f3175d",
              "status": "affected",
              "versionType": "git",
              "lessThan": "bc90144ce8bb7fcf05ad9417c7adb4e9509d9e13"
            },
            {
              "version": "299f962c0b02d048fb45d248b4da493d03f3175d",
              "status": "affected",
              "versionType": "git",
              "lessThan": "bbf0a8e931204ecdab494a88d43b0a24a04285c5"
            },
            {
              "version": "ef7902be3f215b6bf7babe4dc9dd9a7d57dad7a7",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "6.1.175",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.1.184"
            },
            {
              "version": "6.6.136",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.6.148"
            },
            {
              "version": "6.12.84",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.12.101"
            },
            {
              "version": "6.18.25",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.18.42"
            },
            {
              "version": "7.0.2",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "7.1"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "7.1",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "7.1"
            },
            {
              "version": "6.1.184",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.148",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.101",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.18.42",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "7.1.6",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "version": "7.2",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}