CVE-2026-93812 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr
ndr_encode_v4_ntacl() allocates sd_ndr.data via kzalloc() at entry. If any subsequent ndr_write_*() call returns error during encoding, the allocated sd_ndr.data won't be freed and causes memory leak.
Move kfree(sd_ndr.data) into out label to ensure the buffer gets released on all success and error return paths.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/24/2026
The ksmbd subsystem within the Linux kernel manages Server Message Block protocol operations, facilitating file sharing between Windows clients and Linux servers. A critical memory management flaw was identified in the function responsible for setting security descriptors via extended attributes, specifically within the handling of Network Data Representation (NDR) encoded data structures. This vulnerability stems from an improper error handling path during the encoding process where allocated resources are not correctly released upon failure conditions.
The technical root cause lies in the execution flow of ndr_encode_v4_ntacl(). During its operation, this function allocates a buffer for sd_ndr.data using kzalloc to store encoded security descriptor information. The encoding process involves multiple subsequent calls to ndr_write_* functions which may fail due to various internal constraints or invalid input data. In the original implementation, if any of these intermediate write operations returned an error code, the execution path would exit without invoking kfree on the previously allocated sd_ndr.data buffer. This oversight results in a persistent memory leak where kernel heap memory is consumed but never returned to the system pool for reuse.
From a security and operational impact perspective, this vulnerability represents a classic resource exhaustion vector classified under CWE-401: Missing Release of Memory after Effective Lifetime. While individual leaks from single encoding failures may seem negligible, an attacker capable of triggering repeated failed NDR encoding operations can systematically deplete kernel memory resources. Over time, this cumulative leakage contributes to increased system latency and potentially leads to a Denial of Service condition as the available free memory diminishes. In severe cases, persistent allocation without deallocation in the kernel space can destabilize the entire operating environment by exhausting critical memory reserves required for other essential processes.
The remediation strategy involves restructuring the control flow within ksmbd_vfs_set_sd_xattr to ensure deterministic resource cleanup. By moving the kfree(sd_ndr.data) call into a centralized output label, the code guarantees that the allocated buffer is released regardless of whether the encoding process succeeds or encounters an error during any ndr_write_* invocation. This pattern aligns with standard defensive programming practices in kernel development where all exit paths must explicitly manage resource lifecycles to prevent leaks.
This issue maps directly to ATT&CK technique T1496: Resource Hijacking, specifically within the context of local denial-of-service via resource exhaustion. Mitigation requires applying the upstream Linux kernel patch that corrects this memory management logic. System administrators should ensure their systems are updated with a kernel version containing this fix. Additionally, monitoring tools can be configured to track kmalloc allocations and frees in real-time to detect anomalous patterns indicative of such leaks before they escalate into service-affecting conditions. Regular auditing of kernel subsystem code for proper error path handling remains essential for maintaining long-term system stability and security posture.