{"id":5323,"date":"2026-09-04T18:47:45","date_gmt":"2026-09-04T10:47:45","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-68098"},"modified":"2026-09-04T18:47:45","modified_gmt":"2026-09-04T10:47:45","slug":"cve-2026-68098","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-68098","title":{"rendered":"CVE-2026-68098 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: bound DACL ded"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ksmbd: bound DACL dedup walk to copied ACEs<\/p>\n<p>set_ntacl_dacl() can stop copying ACEs before consuming the full input<br \/>\nDACL when size accounting overflows.<\/p>\n<p>When that happens, num_aces reflects only the ACEs that were actually<br \/>\ncopied into the output DACL, but set_posix_acl_entries_dacl() still<br \/>\nreceives nt_num_aces and uses it to walk the existing ACE array during<br \/>\ndedup.<\/p>\n<p>That makes the dedup walk scan past the copied ACE array and inspect<br \/>\nbuffer tail that does not contain valid ACEs.<\/p>\n<p>Split the two meanings currently carried by the NT ACE count. Pass the<br \/>\nnumber of copied NT ACEs to bound the dedup walk, and preserve the<br \/>\noriginal &#8220;input DACL had NT ACEs&#8221; state separately for the<br \/>\nEveryone\/default ACL fallback.<\/p>\n<p>This keeps the dedup walk aligned with the ACEs that are actually<br \/>\npresent in the rebuilt DACL.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ksmbd: bound DACL dedup walk to copied ACEs<\/p>\n<p>set_ntacl_dacl() can stop copying ACEs before consuming the full input<br \/>\nDACL when size <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5323","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5323","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5323"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5323"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5323"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}