# CVE-2026-68099: ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL

CVE-2026-68099 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-68099, released August 11, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-68099
- Priority: Routine
- CVSS: 4.3 (Moderate)
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 10, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68099

## Description

In the Linux kernel, the following vulnerability has been resolved:  ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL  check_add_overflow() unconditionally writes the truncated sum into *d even on overflow, per its contract in include/linux/overflow.h. The four check_add_overflow() guards in set_posix_acl_entries_dacl() and set_ntacl_dacl() break out of the ACE-building loops on overflow, but the truncated *size is then consumed downstream at the end of set_ntacl_dacl():      pndacl->size = cpu_to_le16(le16_to_cpu(pndacl->size) + size);  This produces an on-wire NT ACL whose pndacl->size under-reports the bytes actually written by the preceding fill_ace_for_sid()/memcpy() calls, yielding a malformed ACL that can trigger out-of-bounds reads when re-parsed by clients or ksmbd itself.  Restore *size to its pre-addition value on each overflow branch (via `*size -= ace_sz` / `size -= nt_ace_size`) so that after the break, *size once again holds the cumulative size of the successfully-written ACEs. The committed ACL is then truncated-but-self-consistent rather than malformed.  The ksmbd DACL builders are the only check_add_overflow() sites found where an overflow path breaks out of a loop and the destination value is consumed afterward. The other nearby break-style cases either return -EINVAL on overflow (transport_ipc.c) or break without consuming the overflowed destination value afterward (buildid.c).

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.187-1 | [DEBIAN-CVE-2026-68099](https://patchblox.com/security/data/fix/linux/debian-cve-2026-68099.md) | Aug 11, 2026 |
| Linux | linux Debian 13.5 (trixie) | 6.12.101-1 | [DEBIAN-CVE-2026-68099](https://patchblox.com/security/data/fix/linux/debian-cve-2026-68099.md) | Aug 11, 2026 |
| Linux | linux Debian 14 | 7.1.6-1 | [DEBIAN-CVE-2026-68099](https://patchblox.com/security/data/fix/linux/debian-cve-2026-68099.md) | Aug 11, 2026 |
| Linux | linux-6.12 Debian 12.15 (bookworm) | 6.12.101-1~deb12u1 | [DEBIAN-CVE-2026-68099](https://patchblox.com/security/data/fix/linux/debian-cve-2026-68099.md) | Aug 11, 2026 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.