Description
In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow

Commit 299f962c0b02 ("ksmbd: use check_add_overflow() to prevent u16
DACL size overflow") added check_add_overflow() guards that break out
of the ACE-building loops in set_posix_acl_entries_dacl() when the
accumulated DACL size would wrap past 65535.

However, each iteration allocates a struct smb_sid via kmalloc_obj()
at the top of the loop and relies on the kfree(sid) call at the end
of the loop body (the 'pass_same_sid' label in the first loop, and
the explicit kfree at the tail of the second loop) to release it.
The newly introduced 'break' statements bypass those kfree() calls,
leaking the sid buffer every time an overflow is detected.

A malicious or malformed file with enough POSIX ACL entries to trip
the overflow check will leak one or more struct smb_sid allocations
on every request that touches the file's DACL, providing a trivial
kernel memory exhaustion vector.

Free sid before breaking out of the loops to plug the leak.
Published: 2026-07-19
Score: n/a
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A memory leak in the Linux kernel's ksmbd component is triggered when processing POSIX ACL entries. The bug allows a malicious or malformed file with enough ACL entries to cause an overflow check that bypasses a kfree call, causing kernel memory to be leaked on each request that touches the file's DACL. Repeated leaks can exhaust kernel memory and result in a denial-of-service attack. The flaw originates from a missing deallocation of SMB SID structures when the newly added check_add_overflow() guard breaks out of the ACE-building loops.

Affected Systems

All Linux kernel releases that include the ksmbd module and are older than the commit that introduces the overflow guard (commit 299f962c0b02). No vendor beyond the Linux kernel is specifically listed, but any system running ksmbd before this patch is affected.

Risk and Exploitability

The EPSS score for this vulnerability is less than 1%, indicating a low probability of exploitation at this time, and it is not listed in the CISA KEV catalog. The flaw can be triggered by a crafted SMB request that contains a large number of POSIX ACL entries. It is inferred that because ksmbd is a network-facing service, a remote attacker with SMB access could engage the vulnerability; this inference is drawn from the service’s interface, as the data does not explicitly state the attack vector.

Generated by OpenCVE AI on July 30, 2026 at 20:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the system to a Linux kernel that includes the ksmbd memory-leak fix (commit 299f962c0b02 or later).
  • If an immediate kernel upgrade is not possible, consider disabling or limiting access to the ksmbd SMB service until the patch can be applied.
  • In virtualized or containerized environments, ensure that the host kernel is patched to include the ksmbd fix so that all guest containers are also protected.

Generated by OpenCVE AI on July 30, 2026 at 20:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8593-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8618-1 Linux kernel vulnerabilities
History

Mon, 20 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-772
References

Sun, 19 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow Commit 299f962c0b02 ("ksmbd: use check_add_overflow() to prevent u16 DACL size overflow") added check_add_overflow() guards that break out of the ACE-building loops in set_posix_acl_entries_dacl() when the accumulated DACL size would wrap past 65535. However, each iteration allocates a struct smb_sid via kmalloc_obj() at the top of the loop and relies on the kfree(sid) call at the end of the loop body (the 'pass_same_sid' label in the first loop, and the explicit kfree at the tail of the second loop) to release it. The newly introduced 'break' statements bypass those kfree() calls, leaking the sid buffer every time an overflow is detected. A malicious or malformed file with enough POSIX ACL entries to trip the overflow check will leak one or more struct smb_sid allocations on every request that touches the file's DACL, providing a trivial kernel memory exhaustion vector. Free sid before breaking out of the loops to plug the leak.
Title ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-19T15:40:32.459Z

Reserved: 2026-07-19T07:54:57.037Z

Link: CVE-2026-64139

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity :

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64139 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T20:30:04Z

Weaknesses
  • CWE-772

    Missing Release of Resource after Effective Lifetime