« Volver al listado

CVE-2026-93812

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr

ndr_encode_v4_ntacl() allocates sd_ndr.data via kzalloc() at entry. If any subsequent ndr_write_*() call returns error during encoding, the allocated sd_ndr.data won't be freed and causes memory leak.

Move kfree(sd_ndr.data) into out label to ensure the buffer gets released on all success and error return paths.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-93812",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "303fff2b8c77a85c62dbde3b27c24b084144c04c",
              "lessThan": "306d6f370da7e0e5532dc51c972f4ce101e42431",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "303fff2b8c77a85c62dbde3b27c24b084144c04c",
              "lessThan": "dc55270e410ccb4d24e637c13b5c4c25bcd106d7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "303fff2b8c77a85c62dbde3b27c24b084144c04c",
              "lessThan": "c866c3314a6853eb06c7a8bef67f43c8a8bdfb6e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "303fff2b8c77a85c62dbde3b27c24b084144c04c",
              "lessThan": "9b4dec75498fd0a1c9eaea680aef59c9519eb16f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "303fff2b8c77a85c62dbde3b27c24b084144c04c",
              "lessThan": "c521dd78e036b5e0cfd394dd2ff2218890dd9e41",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "303fff2b8c77a85c62dbde3b27c24b084144c04c",
              "lessThan": "d4d56b00c7df88cd5751e7415bdfabc9fdbc82a7",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/smb/server/vfs.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.15",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/smb/server/vfs.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-24T17:17:14.657",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/306d6f370da7e0e5532dc51c972f4ce101e42431",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9b4dec75498fd0a1c9eaea680aef59c9519eb16f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c521dd78e036b5e0cfd394dd2ff2218890dd9e41",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c866c3314a6853eb06c7a8bef67f43c8a8bdfb6e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d4d56b00c7df88cd5751e7415bdfabc9fdbc82a7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/dc55270e410ccb4d24e637c13b5c4c25bcd106d7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr\n\nndr_encode_v4_ntacl() allocates sd_ndr.data via kzalloc() at entry.\nIf any subsequent ndr_write_*() call returns error during encoding,\nthe allocated sd_ndr.data won't be freed and causes memory leak.\n\nMove kfree(sd_ndr.data) into out label to ensure the buffer gets\nreleased on all success and error return paths."
    }
  ],
  "lastModified": "2026-10-03T11:17:50.993",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}