Out-of-bounds read in Linux kernel - CVE-2026-68098

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU142223

Out-of-bounds read in Linux kernel - CVE-2026-68098

Published: August 12, 2026


Vulnerability identifier: #VU142223
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-68098
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in set_posix_acl_entries_dacl() in ksmbd when processing a DACL whose ACE copying stops early because size accounting overflows. A local user can provide a crafted DACL that causes the dedup walk to scan past the copied ACE array and disclose sensitive information.

The issue occurs because the dedup walk is bounded by the original NT ACE count rather than the number of ACEs actually copied into the rebuilt DACL.


Affected software

Linux kernel
Ubuntu
linux-gcp-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)

How to mitigate CVE-2026-68098

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-gcp-7.0 (Ubuntu package) - addressed in versions 7.0.0-38.38~24.04.4, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14~24.04.1
linux-azure-7.0 (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1017.17~24.04.1

External References

Related Security Bulletins