CVE-2026-64139
Description
A flaw was found in the ksmbd (kernel SMB daemon) component of the Linux kernel. A malicious or specially crafted file with a large number of POSIX Access Control List (ACL) entries can trigger a memory leak in the set_posix_acl_entries_dacl() function. This occurs when the accumulated DACL size overflows, causing struct smb_sid buffers to not be properly freed. An attacker can exploit this vulnerability to cause kernel memory exhaustion, leading to a Denial of Service (DoS) on the affected system.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Other); DoS: Resource Consumption (Memory); DoS: Resource Consumption (CPU)
An attacker that can influence the allocation of resources that are not properly released could deplete the available resource pool and prevent all other processes from accessing the same type of resource. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
