In the Linux kernel, the following vulnerability has been resolved:

ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling

1. When ndr_decode_v4_ntacl() fails, the code jumped to free_n_data
which only freed n.data, skipping kfree(acl.sd_buf) and leaking
the buffer. Zero-initialize struct xattr_ntacl acl, reorder error
labels to out_free to release acl.sd_buf on all error paths.

2. if (acl.sd_size < sizeof(struct smb_ntsd)) is true, original code
returned success without freeing sd_buf and left stale *pntsd.
Set rc = -EINVAL before jumping to out_free to return error code and
free buffer.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < c3836f55e0dab96314774215e12d87f63fa919f2
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 6e6329322ad733c5b23555c609353841560b26bc
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < d708a36634bb7b6f94d0e76d587d2ec50b2b93b5
0 affected < 6.12.111
0 affected < 6.18.53
Linux Linux affected
Version Status Constraints
6.12.111 unaffected ≤ 6.12.*
6.18.53 unaffected ≤ 6.18.*
7.2 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/6e6329322ad733c5b23555c609353841560b26bc cve-icon
https://git.kernel.org/stable/c/c3836f55e0dab96314774215e12d87f63fa919f2 cve-icon
https://git.kernel.org/stable/c/d708a36634bb7b6f94d0e76d587d2ec50b2b93b5 cve-icon
History

Thu, 24 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling 1. When ndr_decode_v4_ntacl() fails, the code jumped to free_n_data which only freed n.data, skipping kfree(acl.sd_buf) and leaking the buffer. Zero-initialize struct xattr_ntacl acl, reorder error labels to out_free to release acl.sd_buf on all error paths. 2. if (acl.sd_size < sizeof(struct smb_ntsd)) is true, original code returned success without freeing sd_buf and left stale *pntsd. Set rc = -EINVAL before jumping to out_free to return error code and free buffer.
Title ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-24T16:02:47.745Z

Reserved: 2026-09-18T17:59:28.790Z

Link: CVE-2026-93811

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.