CVE-2026-64139

What it actually does

This flaw is a kernel memory leak in the Linux ksmbd SMB server. When ksmbd builds a Windows DACL from POSIX ACL entries, an overflow guard can stop processing after allocating an SMB SID object but before freeing it. A malicious or malformed file with enough ACL entries can repeatedly trigger this path, leaking kernel memory on each request that causes ksmbd to inspect or construct the file DACL. The practical technical impact is local or network-triggered denial of service against systems running vulnerable ksmbd, potentially leading to kernel memory exhaustion, degraded SMB service, OOM conditions, or system instability.

Why it matters to the business

Systems using the in-kernel Linux SMB server may be vulnerable to service disruption if an attacker can create or access files with specially crafted or excessive ACL entries. Business impact can include unavailable file shares, interruption of applications depending on SMB storage, degraded server performance, and possible host instability requiring emergency remediation or reboot. EPSS is currently low and the vulnerability is not listed in CISA KEV, but because the affected component runs in kernel space and can be triggered repeatedly, exposed ksmbd deployments should still be prioritized for patching.

How an attack unfolds

An attacker first needs a path to interact with a vulnerable ksmbd SMB share and a way to cause ksmbd to process a file whose POSIX ACL entries are large enough to trigger the DACL size overflow check. This may involve creating a file with excessive ACL entries if the attacker has write or ACL modification rights, or repeatedly accessing an already malformed file if one exists. When ksmbd attempts to translate the file's POSIX ACLs into SMB DACL entries, it allocates a struct smb_sid during each loop iteration. If the accumulated DACL size would exceed the 16-bit limit, the overflow guard breaks out of the loop without freeing the SID allocation. Repeating SMB operations that touch the file's DACL leaks kernel memory over time. With enough repetitions, the host may experience memory pressure, ksmbd failures, OOM-killer activity, degraded performance, or a broader denial of service.

How to fix it

Upgrade the Linux kernel to a vendor release that includes the ksmbd fix for the SID leak in set_posix_acl_entries_dacl(). No exact fixed package versions were provided in the input, so use the relevant distribution security advisory or upstream stable kernel release notes to identify the corrected kernel for each platform. If immediate patching is not possible, reduce exposure by disabling ksmbd where it is not required, blocking SMB access from untrusted networks, limiting SMB share access to trusted users, and restricting permissions that allow users to create files or set unusually large POSIX ACLs. Consider using Samba in user space instead of ksmbd where operationally appropriate and supported. Reboot into the patched kernel after installation; merely installing kernel packages is not sufficient if the vulnerable kernel remains running.

How to confirm the fix worked

Confirm the running kernel, not only the installed kernel package, contains the fix. Validate by checking the distribution advisory for CVE-2026-64139 or the upstream kernel commit that frees the SID allocation before breaking out of the ACL-building loops. Confirm whether ksmbd is enabled or loaded using service status, loaded module checks, and SMB listener checks. Review SMB shares for files with unusually large POSIX ACLs and test representative SMB security descriptor or ACL query operations after patching while monitoring kernel memory behavior. A patched system should not show repeatable kernel memory growth when ksmbd processes files with large ACLs.

Typical attack path

1. Identify a Linux SMB service using the in-kernel ksmbd server rather than a fully patched kernel or alternative SMB implementation.
2. Authenticate to an SMB share or otherwise reach a file path that ksmbd will process.
3. Create or locate a file with enough POSIX ACL entries to cause DACL size accumulation to exceed the supported limit.
4. Trigger SMB operations that require ksmbd to inspect, query, or construct the file's security descriptor or DACL.
5. Repeat the operation to leak kernel memory on each request.
6. Continue until ksmbd, the affected workload, or the host experiences memory exhaustion or instability.

How to detect it

Look for evidence of repeated SMB operations against files with unusually large ACLs followed by increasing kernel memory usage, ksmbd instability, or OOM events. Relevant sources include kernel logs, systemd journal, auditd logs for ACL changes, SMB/ksmbd logs if enabled, endpoint telemetry, and network flow logs for high-frequency SMB activity. Investigate spikes in SMB requests that query security descriptors or ACLs, repeated access to the same file paths, recent setfacl or ACL modification activity, and unexplained memory pressure on hosts running ksmbd. Kernel logs may not explicitly name this vulnerability, so detection should correlate ksmbd activity with OOM-killer messages, slab growth, failed allocations, service restarts, or host instability. If kernel memory leak detection is enabled in test or forensic environments, search for leaked SID-related allocations or references to the vulnerable ksmbd ACL conversion path.

• ksmbd
• set_posix_acl_entries_dacl
• struct smb_sid
• kmalloc_obj
• Out of memory: Killed process
• oom-killer
• Memory allocation failure
• page allocation failure
• ksmbd.mountd
• /sys/module/ksmbd
• /proc/fs/ksmbd
• /proc/slabinfo
• setfacl
• getfacl

What your security team should do

• Inventory Linux systems exposing SMB and determine which use ksmbd.
• Prioritize patching internet-facing, partner-facing, or broadly accessible SMB servers first, followed by internal file servers with many untrusted users.
• Upgrade to a vendor kernel containing the ksmbd SID leak fix and reboot into the fixed kernel.
• Temporarily disable ksmbd or restrict SMB access to trusted networks if patching cannot be completed quickly.
• Audit SMB shares for files with unusually large or malformed POSIX ACLs, especially in directories writable by less-trusted users.
• Monitor kernel memory pressure, OOM-killer activity, ksmbd errors, and repeated SMB security descriptor or ACL queries until remediation is complete.
• Add compensating controls that limit who can set ACLs or create files on ksmbd-backed shares.