CVE-2026-68097: ksmbd: validate ACE size against SID sub-authorities

CVE-2026-68097: ksmbd: validate ACE size against SID sub-authorities

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate ACE size against SID sub-authorities

set_ntacl_dacl() validates sid.num_subauth before copying an ACE, but
does not verify that the declared ACE size contains all sub-authorities
described by that field. An undersized ACE can therefore be copied
and later make the POSIX ACL deduplication walk inspect data beyond
the copied ACE boundary.

The existing initial bound check is also too small. It only ensures
that the ACE size field is accessible before set_ntacl_dacl() reads
sid.num_subauth farther into the input buffer.

Require enough input for the fixed SID header before accessing
num_subauth, reject ACEs smaller than that header, and skip ACEs
whose declared size cannot contain the complete SID. This makes the
validation consistent with the other ACE walk paths.

The Linux kernel CVE team has assigned CVE-2026-68097 to this issue.


Affected and fixed versions
===========================

	Fixed in 6.6.148 with commit b7cb5bf0855470799f12da825de91e48951b3876
	Fixed in 6.12.101 with commit 62d80d7c2d9428085e7458ad4c06ca8c0984039b
	Fixed in 6.18.42 with commit 337022d9dfac441c3b35e4455a51aa981996e02e
	Fixed in 7.1.6 with commit 61fd3559199f7fa693dcbff35e59477e24af041a
	Fixed in 7.2-rc5 with commit 5152c6d49e3fd4e9f2e857c57527aead752f1f87

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68097
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/smb/server/smbacl.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b7cb5bf0855470799f12da825de91e48951b3876
	https://git.kernel.org/stable/c/62d80d7c2d9428085e7458ad4c06ca8c0984039b
	https://git.kernel.org/stable/c/337022d9dfac441c3b35e4455a51aa981996e02e
	https://git.kernel.org/stable/c/61fd3559199f7fa693dcbff35e59477e24af041a
	https://git.kernel.org/stable/c/5152c6d49e3fd4e9f2e857c57527aead752f1f87