CVE-2026-93811 (GCVE-0-2026-93811)
Vulnerability from cvelistv5
Published
2026-09-24 16:02
Modified
2026-10-03 10:57
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling 1. When ndr_decode_v4_ntacl() fails, the code jumped to free_n_data which only freed n.data, skipping kfree(acl.sd_buf) and leaking the buffer. Zero-initialize struct xattr_ntacl acl, reorder error labels to out_free to release acl.sd_buf on all error paths. 2. if (acl.sd_size < sizeof(struct smb_ntsd)) is true, original code returned success without freeing sd_buf and left stale *pntsd. Set rc = -EINVAL before jumping to out_free to return error code and free buffer.
References
Impacted products
Vendor Product Version
Linux Linux Version: cb69d4d6f709f87c94afa28ae64c501576692171
Version: 8f0541186e9ad1b62accc9519cc2b7a7240272a7
Version: 8f0541186e9ad1b62accc9519cc2b7a7240272a7
Version: 8f0541186e9ad1b62accc9519cc2b7a7240272a7
Version: 8f0541186e9ad1b62accc9519cc2b7a7240272a7
Version: 8f0541186e9ad1b62accc9519cc2b7a7240272a7
Version: 6e8f4abf584253cbaa596ea4ad13110cf61cd4c9
Version: 8e33102309bd6839b2e2e158f93a7b378cb4655d
Version: 5.15.62   ≤
Version: 5.18.18   ≤
Version: 5.19.2   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/vfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f46a70a082bdbfecbe074af8a719c26c4deb58c6",
              "status": "affected",
              "version": "cb69d4d6f709f87c94afa28ae64c501576692171",
              "versionType": "git"
            },
            {
              "lessThan": "86c2625fb9863139b359805fc6be1e31edbd3d65",
              "status": "affected",
              "version": "8f0541186e9ad1b62accc9519cc2b7a7240272a7",
              "versionType": "git"
            },
            {
              "lessThan": "edc17db83085624a2b1bacf6a4521d7f15571737",
              "status": "affected",
              "version": "8f0541186e9ad1b62accc9519cc2b7a7240272a7",
              "versionType": "git"
            },
            {
              "lessThan": "c3836f55e0dab96314774215e12d87f63fa919f2",
              "status": "affected",
              "version": "8f0541186e9ad1b62accc9519cc2b7a7240272a7",
              "versionType": "git"
            },
            {
              "lessThan": "6e6329322ad733c5b23555c609353841560b26bc",
              "status": "affected",
              "version": "8f0541186e9ad1b62accc9519cc2b7a7240272a7",
              "versionType": "git"
            },
            {
              "lessThan": "d708a36634bb7b6f94d0e76d587d2ec50b2b93b5",
              "status": "affected",
              "version": "8f0541186e9ad1b62accc9519cc2b7a7240272a7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6e8f4abf584253cbaa596ea4ad13110cf61cd4c9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8e33102309bd6839b2e2e158f93a7b378cb4655d",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.222",
              "status": "affected",
              "version": "5.15.62",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19",
              "status": "affected",
              "version": "5.18.18",
              "versionType": "semver"
            },
            {
              "lessThan": "5.20",
              "status": "affected",
              "version": "5.19.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/vfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "5.15.62",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.18.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.19.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling\n\n1. When ndr_decode_v4_ntacl() fails, the code jumped to free_n_data\n   which only freed n.data, skipping kfree(acl.sd_buf) and leaking\n   the buffer. Zero-initialize struct xattr_ntacl acl, reorder error\n   labels to out_free to release acl.sd_buf on all error paths.\n\n2. if (acl.sd_size \u003c sizeof(struct smb_ntsd)) is true, original code\n   returned success without freeing sd_buf and left stale *pntsd.\n   Set rc = -EINVAL before jumping to out_free to return error code and\n   free buffer."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T10:57:43.607Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f46a70a082bdbfecbe074af8a719c26c4deb58c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/86c2625fb9863139b359805fc6be1e31edbd3d65"
        },
        {
          "url": "https://git.kernel.org/stable/c/edc17db83085624a2b1bacf6a4521d7f15571737"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3836f55e0dab96314774215e12d87f63fa919f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e6329322ad733c5b23555c609353841560b26bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/d708a36634bb7b6f94d0e76d587d2ec50b2b93b5"
        }
      ],
      "title": "ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93811",
    "datePublished": "2026-09-24T16:02:47.745Z",
    "dateReserved": "2026-09-18T17:59:28.790Z",
    "dateUpdated": "2026-10-03T10:57:43.607Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.