Linux Kernel ksmbd CVE-2026-68098

ksmbd is the in-kernel SMB (Server Message Block) server introduced in Linux 5.15 as a high-performance alternative to userspace Samba. The vulnerability resides in DACL (Discretionary Access Control List) processing: set_ntacl_dacl() copies NT ACEs (Access Control Entries) from a client-supplied input DACL into an output structure, stopping early when cumulative size accounting overflows an internal bound. The dedup function set_posix_acl_entries_dacl() then walks the ACE array for deduplication using nt_num_aces - the original input count - rather than the count of ACEs that were actually transferred. This off-by-variable mismatch drives the walk past the populated region into buffer tail memory that holds no valid ACE data. The root cause class aligns with CWE-125 (Out-of-Bounds Read) or CWE-120 (Buffer Copy Without Checking Size of Input), even though CWE is listed as N/A in the NVD entry. The fix decouples the two semantic meanings carried by the NT ACE count, passing the copied-ACE count to bound the dedup walk while preserving the original input-count state for the Everyone/default ACL fallback path. Affected CPE: cpe:2.3:a:linux:linux across multiple stable branches. The bug is reachable only when ksmbd is loaded and an SMB share is configured.