CVE-2026-93811 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems that utilize the ksmbd module should review and apply the provided source code patches to fix the vulnerability. The vulnerability may allow attackers to exploit the vulnerability or launch denial-of-service (DoS) attacks. Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems that utilize the ksmbd module are

Why it matters

The Linux kernel's ksmbd module has a memory leak and invalid error handling vulnerability, which may allow attackers to exploit the vulnerability or launch denial-of-service (DoS) attacks. Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems that utilize the ksmbd module should review and apply the provided source code patches to fix the vulnerability.

• Memory leak vulnerability may lead to denial-of-service (DoS) attacks.
• Invalid error handling may allow attackers to exploit the vulnerability.

Technical summary

The Linux kernel's ksmbd module has a memory leak and invalid error handling vulnerability. When ndr_decode_v4_ntacl() fails, the code jumps to free_n_data, which only frees n.data and skips kfree(acl.sd_buf), resulting in a memory leak. Additionally, if acl.sd_size is less than sizeof(struct smb_ntsd), the original code returns success without freeing sd_buf, leaving a stale *pntsd. This vulnerability may allow attackers to exploit the vulnerability or launch denial-of-service (DoS) attacks. Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems that utilize the ksmbd module should review and apply the provided source code patches to fix the vulnerability.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided source code patches to fix the memory leak and invalid error handling vulnerability in the Linux kernel's ksmbd module.
• Verify the Linux kernel version and check if the patch has been applied.
• Monitor the Linux kernel's ksmbd module for any potential issues related to this vulnerability.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its description and references to source code changes. The Linux kernel's ksmbd module has a memory leak and invalid error handling vulnerability. The vulnerability occurs when the ndr_decode_v4_ntacl() function fails, causing the code to jump to free_n_data, which only frees n.data and skips kfree(acl.sd_buf), resulting in a memory leak. Additionally, if acl.sd_size is less than sizeof(struct smb_ntsd), the original code returns The

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.