CVE-2026-93812: ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix sdndr.data memory leak in ksmbdvfssetsdxattr
ndrencodev4ntacl() allocates sdndr.data via kzalloc() at entry. If any subsequent ndrwrite() call returns error during encoding, the allocated sdndr.data won't be freed and causes memory leak.
Move kfree(sdndr.data) into out label to ensure the buffer gets released on all success and error return paths.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this leak?
The affected code is in ksmbd, the Linux kernel SMB server component. Exposure therefore depends on ksmbd being in use and on execution reaching the security-descriptor xattr update path.
What triggers the memory leak?
The leak occurs when ndr_encode_v4_ntacl() allocates sd_ndr.data and a later ndr_write_*() operation fails during encoding. On those error paths, the allocated buffer was not released.
How can I determine whether a kernel contains the fix?
Check whether the kernel source includes the change that moves kfree(sd_ndr.data) to the common out label in ksmbd_vfs_set_sd_xattr. The provided stable references identify commits carrying that change.