CVE-2026-64139: Linux Kernel KSMBD Information Disclosure

CVE-2026-64139 Overview

CVE-2026-64139 is a memory leak vulnerability in the Linux kernel's ksmbd SMB server implementation. The flaw resides in the set_posix_acl_entries_dacl() function, where overflow-guard break statements bypass the kfree(sid) cleanup path. Each iteration of the ACE-building loop allocates a struct smb_sid via kmalloc_obj(), and skipping the free on overflow leaks that buffer. A remote attacker with access to a ksmbd share can trigger the leak repeatedly by touching files carrying crafted POSIX ACL entries, exhausting kernel memory over time.

Critical Impact
A malicious or malformed file with enough POSIX ACL entries to trip the overflow check leaks one or more struct smb_sid allocations on every request that touches the file's DACL, providing a trivial kernel memory exhaustion vector.

Affected Products

Linux kernel builds with ksmbd enabled (CONFIG_SMB_SERVER)
Kernel branches containing commit 299f962c0b02 ("ksmbd: use check_add_overflow() to prevent u16 DACL size overflow")
Distributions shipping ksmbd as an in-tree SMB server prior to the fix commits referenced by kernel.org

Discovery Timeline

2026-07-19 - CVE-2026-64139 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64139

Vulnerability Analysis

The issue lives in fs/smb/server/smbacl.c inside set_posix_acl_entries_dacl(). This function walks POSIX ACL entries and builds a Discretionary Access Control List (DACL) to return over SMB. Each loop iteration allocates a new struct smb_sid object before appending an Access Control Entry (ACE) to the buffer.

An earlier hardening commit added check_add_overflow() calls to detect when the accumulated 16-bit DACL size would wrap past 65535. When overflow is detected, the code executes a break to abort ACE construction. The cleanup path that frees the SID lives at the tail of the loop body under the pass_same_sid label in the first loop and as an explicit kfree(sid) in the second loop. The break statement jumps past both cleanup points, orphaning the allocation.

Because ksmbd handles this DACL construction for every request that queries or modifies file security descriptors, an authenticated SMB client repeatedly accessing a crafted file drains kernel slab memory. This is a classic [CWE-401] missing release of memory after effective lifetime.

Root Cause

The root cause is control-flow desynchronization between allocation and free. The overflow guard was added defensively but did not account for the outstanding sid allocation held in the loop scope. The pre-existing free relies on falling through to the end of the loop body, which the new break bypasses.

Attack Vector

An attacker with write access to a share exported by ksmbd, or the ability to place a file whose POSIX ACL contains enough entries to exceed the u16 DACL size limit, can trigger the leak. Each SMB operation that retrieves the file's security descriptor causes an additional struct smb_sid to leak in kernel memory. Sustained access yields resource exhaustion and denial of service against the host kernel.

No verified public exploit code is available for this issue. See the upstream commits linked in the Kernel Git Commit Details for the corrective patch.

Detection Methods for CVE-2026-64139

Indicators of Compromise

Steady growth of the kernel slab cache backing smb_sid allocations on hosts running ksmbd, visible via /proc/slabinfo or slabtop.
Rising kernel Slab: and SUnreclaim: counters in /proc/meminfo correlated with SMB traffic from a single client.
SMB clients repeatedly issuing SMB2 QUERY_INFO or SET_INFO requests referencing files with unusually large POSIX ACLs.

Detection Strategies

Monitor ksmbd process memory usage and kernel slab pressure over time, alerting on unbounded growth without corresponding user workload increase.
Log SMB share access patterns and flag clients issuing high-frequency DACL queries against a small set of files.
Audit exported filesystems for files whose POSIX ACL entry count approaches the DACL size limit.

Monitoring Recommendations

Enable kernel memory leak detection via CONFIG_DEBUG_KMEMLEAK on non-production hosts and review /sys/kernel/debug/kmemleak reports referencing smb_sid.
Track ksmbd.mountd and kernel ksmbd worker thread counters for anomalous request rates against ACL-heavy files.
Alert on host memory pressure events on servers exporting SMB shares to untrusted networks.

How to Mitigate CVE-2026-64139

Immediate Actions Required

Apply the upstream kernel patch that frees sid before breaking out of the ACE-building loops in set_posix_acl_entries_dacl().
Restrict access to ksmbd shares to authenticated, trusted clients until the patched kernel is deployed.
Disable ksmbd on hosts that do not require an in-kernel SMB server and use a userspace alternative such as Samba if feasible.

Patch Information

The fix is available in the following upstream commits published on kernel.org:

The patch adds kfree(sid) before each break statement introduced by the earlier overflow-check hardening.

Workarounds

Unload the ksmbd kernel module (modprobe -r ksmbd) on systems that do not require kernel-mode SMB serving.
Firewall the SMB service (TCP/445) to restrict access to trusted management networks only.
Remove or trim POSIX ACLs on exported files so no single file approaches the u16 DACL size boundary.

bash

# Disable and blacklist the ksmbd kernel module until patched
sudo systemctl stop ksmbd.service
sudo modprobe -r ksmbd
echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf

# Restrict SMB access to a trusted management subnet
sudo iptables -A INPUT -p tcp --dport 445 ! -s 10.0.0.0/24 -j DROP