CVE-2026-64139

Medium

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow Commit 299f962c0b02 ("ksmbd: use check_add_overflow() to prevent u16 DACL size overflow") added check_add_overflow() guards that break out of the ACE-building loops in set_posix_acl_entries_dacl() when the accumulated DACL size would wrap past 65535. However, each iteration allocates a struct smb_sid via kmalloc_obj() at the top of the loop and relies on the kfree(sid) call at the end of the loop body (the 'pass_same_sid' label in the first loop, and the explicit kfree at the tail of the second loop) to release it. The newly introduced 'break' statements bypass those kfree() calls, leaking the sid buffer every time an overflow is detected. A malicious or malformed file with enough POSIX ACL entries to trip the overflow check will leak one or more struct smb_sid allocations on every request that touches the file's DACL, providing a trivial kernel memory exhaustion vector. Free sid before breaking out of the loops to plug the leak.

Package Linux Kernel
Published 2026-07-19
Last modified 2026-08-23
CVSS version 3.1
Patch available
Yes

CVSS 3.1 score

5.5

out of 10
Medium
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness type

CWE-401

CVE-2026-64139 is a Memory Leak vulnerability

What is Memory Leak?

The product does not release memory after use, causing gradual resource exhaustion. Learn more on MITRE CWE

Affected versions

Linux kernel versions 6.1.175, 6.6.136, 6.12.84, 6.18.25, 7.0.2 and later are affected. Fixed in 6.1.184, 6.6.142, 6.12.92, 6.18.34, 7.0.11 and their respective stable series.

Affected from
≥ 6.1.175 ≥ 6.6.136 ≥ 6.12.84 ≥ 6.18.25 ≥ 7.0.2
Fixed in
✓ 6.1.184 6.1.x ✓ 6.6.142 6.6.x ✓ 6.12.92 6.12.x ✓ 6.18.34 6.18.x ✓ 7.0.11 7.0.x

References

6 total
Showing 5 of 6 references View all on NVD

Frequently asked questions

  • What is CVE-2026-64139?

    CVE-2026-64139 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 , classified as a Memory Leak flaw (CWE-401) . It affects Linux kernel versions from 6.1.175 onward and has been patched in 6.1.184, 6.6.142, 6.12.92 and others. CVE-2026-64139 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

  • What is the CVSS score for CVE-2026-64139?

    CVE-2026-64139 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H .

  • Is there a patch available for CVE-2026-64139?

    Yes. CVE-2026-64139 has been patched. Fixed versions include 6.1.184, 6.6.142, 6.12.92 and others. If you are running Linux kernel 6.1.175 or later up to the fix versions, apply the relevant patch for your kernel branch.

  • Is CVE-2026-64139 actively exploited?

    No. CVE-2026-64139 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Back to
All CVEs
View on
NVD / NIST