Memory Leak Vulnerability in Linux Kernel ksmbd by Vendor

CVE-2026-64139

What is CVE-2026-64139?

A recent vulnerability in the Linux kernel's ksmbd component inadvertently introduces a memory leak during DACL processing. The issue arises in the set_posix_acl_entries_dacl() function, where improper management of SID memory allocations can lead to memory exhaustion on the kernel. When a file has a malformed amount of POSIX ACL entries that trigger an overflow check, it bypasses the necessary memory release processes, thus leaking allocated memory segments. This flaw not only compromises system efficiency but also opens the door for potential denial-of-service attacks when triggered. Proper safeguards have been proposed to ensure that memory is adequately freed before exiting critical sections of the code to mitigate this risk.

References