CVE-2026-93812

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-93812
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93812.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-93812
Downstream
Published
2026-09-24T16:02:49Z
Modified
2026-10-05T02:30:42Z
Summary
ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr
Details

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr

ndr_encode_v4_ntacl() allocates sd_ndr.data via kzalloc() at entry. If any subsequent ndr_write_*() call returns error during encoding, the allocated sd_ndr.data won't be freed and causes memory leak.

Move kfree(sd_ndr.data) into out label to ensure the buffer gets released on all success and error return paths.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93812.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
303fff2b8c77a85c62dbde3b27c24b084144c04c
Fixed
306d6f370da7e0e5532dc51c972f4ce101e42431
Fixed
dc55270e410ccb4d24e637c13b5c4c25bcd106d7
Fixed
c866c3314a6853eb06c7a8bef67f43c8a8bdfb6e
Fixed
9b4dec75498fd0a1c9eaea680aef59c9519eb16f
Fixed
c521dd78e036b5e0cfd394dd2ff2218890dd9e41
Fixed
d4d56b00c7df88cd5751e7415bdfabc9fdbc82a7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93812.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.15.0
Fixed
5.15.222
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.189
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.158
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.111
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.53

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93812.json"