CVE-2026-64139

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow<br /> <br /> Commit 299f962c0b02 ("ksmbd: use check_add_overflow() to prevent u16<br /> DACL size overflow") added check_add_overflow() guards that break out<br /> of the ACE-building loops in set_posix_acl_entries_dacl() when the<br /> accumulated DACL size would wrap past 65535.<br /> <br /> However, each iteration allocates a struct smb_sid via kmalloc_obj()<br /> at the top of the loop and relies on the kfree(sid) call at the end<br /> of the loop body (the &amp;#39;pass_same_sid&amp;#39; label in the first loop, and<br /> the explicit kfree at the tail of the second loop) to release it.<br /> The newly introduced &amp;#39;break&amp;#39; statements bypass those kfree() calls,<br /> leaking the sid buffer every time an overflow is detected.<br /> <br /> A malicious or malformed file with enough POSIX ACL entries to trip<br /> the overflow check will leak one or more struct smb_sid allocations<br /> on every request that touches the file&amp;#39;s DACL, providing a trivial<br /> kernel memory exhaustion vector.<br /> <br /> Free sid before breaking out of the loops to plug the leak.