CVE-2026-64139 Linux CVE debrief

Who should care

Linux kernel users, administrators, and developers who utilize ksmbd for file sharing should be aware of this vulnerability and take steps to mitigate it. They should review system configurations, ensure that updates are applied, and monitor for potential exploitation attempts. Additionally, they should consider implementing compensating controls such as memory protection mechanisms and monitoring system resources for signs of memory exhaustion.

Technical summary

The vulnerability exists in the set_posix_acl_entries_dacl() function of the ksmbd module in the Linux kernel. The function fails to free the allocated struct smb_sid when the accumulated DACL size overflows, leading to a memory leak. This can be triggered by a file with a large number of POSIX ACL entries. The vulnerability was introduced by a commit that added overflow checks but did not properly handle memory deallocation in case of an overflow. The fix involves freeing the sid buffer before breaking out of the loops. A malicious or malformed file with enough POSIX ACL entries to trip the overflow check will leak one or more struct smb_sid allocations on every request that touches the file's DACL, providing a trivial kernel memory exhaustion vector.

Defensive priority

High

Recommended defensive actions

• Apply the official patch or update the Linux kernel to a version that includes the fix.
• Limit access to sensitive files and directories.
• Monitor system resources for signs of memory exhaustion.
• Implement compensating controls, such as memory protection mechanisms.
• Review system configurations and ensure that ksmbd is properly configured.
• Conduct regular security audits to identify potential vulnerabilities.
• Stay informed about the latest security advisories and updates.

Evidence notes

The vulnerability was introduced by a commit that added overflow checks but did not properly handle memory deallocation in case of an overflow. The fix involves freeing the sid buffer before breaking out of the loops. A source reference for the vulnerability fix is available, providing additional details on the issue and the resolution.

Official resources