https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 13:02:20 +0000 https://vulnerability.circl.lu/vuln/cve-2026-64139 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow</p> <p>Commit 299f962c0b02 (&#34;ksmbd: use check_add_overflow() to prevent u16 DACL size overflow&#34;) added check_add_overflow() guards that break out of the ACE-building loops in set_posix_acl_entries_dacl() when the accumulated DACL size would wrap past 65535.</p> <p>However, each iteration allocates a struct smb_sid via kmalloc_obj() at the top of the loop and relies on the kfree(sid) call at the end of the loop body (the &#39;pass_same_sid&#39; label in the first loop, and the explicit kfree at the tail of the second loop) to release it. The newly introduced &#39;break&#39; statements bypass those kfree() calls, leaking the sid buffer every time an overflow is detected.</p> <p>A malicious or malformed file with enough POSIX ACL entries to trip the overflow check will leak one or more struct smb_sid allocations on every request that touches the file&#39;s DACL, providing a trivial kernel memory exhaustion vector.</p> <p>Free sid before breaking out of the loops to plug the leak.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow</p> <p>Commit 299f962c0b02 (&#34;ksmbd: use check_add_overflow() to prevent u16 DACL size overflow&#34;) added check_add_overflow() guards that break out of the ACE-building loops in set_posix_acl_entries_dacl() when the accumulated DACL size would wrap past 65535.</p> <p>However, each iteration allocates a struct smb_sid via kmalloc_obj() at the top of the loop and relies on the kfree(sid) call at the end of the loop body (the &#39;pass_same_sid&#39; label in the first loop, and the explicit kfree at the tail of the second loop) to release it. The newly introduced &#39;break&#39; statements bypass those kfree() calls, leaking the sid buffer every time an overflow is detected.</p> <p>A malicious or malformed file with enough POSIX ACL entries to trip the overflow check will leak one or more struct smb_sid allocations on every request that touches the file&#39;s DACL, providing a trivial kernel memory exhaustion vector.</p> <p>Free sid before breaking out of the loops to plug the leak.</p> https://vulnerability.circl.lu/vuln/cve-2026-64139