CVE-2026-68099

The CVE-2026-68099 vulnerability is in ksmbd within the Linux kernel, where check_add_overflow() could cause an on-wire NT ACL to be malformed. In the affected DACL builders (set_posix_acl_entries_dacl() and set_ntacl_dacl()), overflow handling previously allowed the loop to break while the desti...

CVE-2026-68099 ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL

In the Linux kernel, the following vulnerability has been resolved: ksmbd: restore DACL size on checkaddoverflow to avoid malformed ACL checkaddoverflow unconditionally writes the truncated sum into d even on overflow, per its contract in include/linux/overflow.h. The four checkaddoverflow guards...

EUVD-2026-55479

In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound DACL dedup walk to copied ACEs setntacldacl can stop copying ACEs before consuming the full input DACL when size accounting overflows. When that happens, numaces reflects only the ACEs that were actually copied into...

CVE-2026-68098 ksmbd: bound DACL dedup walk to copied ACEs

In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound DACL dedup walk to copied ACEs setntacldacl can stop copying ACEs before consuming the full input DACL when size accounting overflows. When that happens, numaces reflects only the ACEs that were actually copied into...

CVE-2026-68098 ksmbd: bound DACL dedup walk to copied ACEs

In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound DACL dedup walk to copied ACEs setntacldacl can stop copying ACEs before consuming the full input DACL when size accounting overflows. When that happens, numaces reflects only the ACEs that were actually copied into...

CVE-2026-68098

In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound DACL dedup walk to copied ACEs setntacldacl can stop copying ACEs before consuming the full input DACL when size accounting overflows. When that happens, numaces reflects only the ACEs that were actually copied into...

CVE-2026-68097

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ACE size against SID sub-authorities setntacldacl validates sid.numsubauth before copying an ACE, but does not verify that the declared ACE size contains all sub-authorities described by that field. An undersized...

CVE-2026-68097 ksmbd: validate ACE size against SID sub-authorities

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ACE size against SID sub-authorities setntacldacl validates sid.numsubauth before copying an ACE, but does not verify that the declared ACE size contains all sub-authorities described by that field. An undersized...

CVE-2026-68097 ksmbd: validate ACE size against SID sub-authorities

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ACE size against SID sub-authorities setntacldacl validates sid.numsubauth before copying an ACE, but does not verify that the declared ACE size contains all sub-authorities described by that field. An undersized...

CVE-2026-68097

Summary: CVE-2026-68097 affects the Linux kernel ksmbd path handling POSIX ACLs. The root cause is a check failure in ACE validation: set_ntacl_dacl() validates sid.num_subauth but does not ensure the declared ACE size can contain all sub-authorities, allowing an undersized ACE to be copied and l...

CVE-2026-68083 ksmbd: fix path resolution in ksmbd_vfs_kern_path_create

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix path resolution in ksmbdvfskernpathcreate The SMB2 open lookup is rooted at the share with LOOKUPBENEATH, but the create/mkdir/hardlink sink is not: ksmbdvfskernpathcreate builds an absolute path with converttounixname...

EUVD-2026-55264

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix path resolution in ksmbdvfskernpathcreate The SMB2 open lookup is rooted at the share with LOOKUPBENEATH, but the create/mkdir/hardlink sink is not: ksmbdvfskernpathcreate builds an absolute path with converttounixname...

CVE-2026-68083

CVE-2026-68083 affects ksmbd (Linux kernel in-kernel SMB server). The issue is a path-resolution bug in ksmbd_vfs_kern_path_create() where an SMB2 create/mkdir/hardlink path can leverage a ".." component to escape the share, because the rooted open lookup uses LOOKUP_BENEATH for the SMB2 path but...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: smb/server: Fixed the reference count leak in smb2open. When ksmbdvfsgetattr fails, the reference count of ksmbdfile must be released...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Added channlock to protect the ksmbdchannlist xarray. The ksmbdchannlist xarray lacks synchronization, allowing use-after-free situations in multi-channel sessions between lookupchannlist and ksmbdchanndel. Added a...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb/server: The function ksmbdsessionrpcclose is called on the error path in the createsmb2pipe function. When the ksmbdiovpinrsp function fails, we should call ksmbdsessionrpcclose...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: The infinite loop caused by resetting nextsmb2rcvhdroff during error paths has been fixed. The issue occurs when a signed request fails the smb2 signature verification check. In processrequest, if checksignreq returns an...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: The lock-range check for files with equal size is skipped, to avoid underflow when size == 0. When size equals the current isize including 0, the code that calls checklockrangefilp, isize, size - 1, WRITE will compute size...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: A memory leak was fixed in getfileallinfo. In getfileallinfo, if vfsgetattr fails, the function returns immediately without freeing the allocated filename, resulting in a memory leak. This issue was fixed by freeing the...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb: Server: Fixed a leak of activenumconn in ksmbdtcpnewconnection. When ksmbdtcpnewconnection fails due to a kthreadrun failure, the transport is freed using freetransport, which does not decrement activenumconn, resulting in a...