https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 18:29:57 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-64139 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-64139 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0926 certfr-2026-avi-0926 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0926 https://cve.radiocsirt.org/vuln/euvd-2026-357819 EUVD-2026-357819 https://cve.radiocsirt.org/vuln/euvd-2026-357819 https://cve.radiocsirt.org/vuln/fkie_cve-2026-64139 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow</p> <p>Commit 299f962c0b02 (&#34;ksmbd: use check_add_overflow() to prevent u16 DACL size overflow&#34;) added check_add_overflow() guards that break out of the ACE-building loops in set_posix_acl_entries_dacl() when the accumulated DACL size would wrap past 65535.</p> <p>However, each iteration allocates a struct smb_sid via kmalloc_obj() at the top of the loop and relies on the kfree(sid) call at the end of the loop body (the &#39;pass_same_sid&#39; label in the first loop, and the explicit kfree at the tail of the second loop) to release it. The newly introduced &#39;break&#39; statements bypass those kfree() calls, leaking the sid buffer every time an overflow is detected.</p> <p>A malicious or malformed file with enough POSIX ACL entries to trip the overflow check will leak one or more struct smb_sid allocations on every request that touches the file&#39;s DACL, providing a trivial kernel memory exhaustion vector.</p> <p>Free sid before breaking out of the loops to plug the leak.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow</p> <p>Commit 299f962c0b02 (&#34;ksmbd: use check_add_overflow() to prevent u16 DACL size overflow&#34;) added check_add_overflow() guards that break out of the ACE-building loops in set_posix_acl_entries_dacl() when the accumulated DACL size would wrap past 65535.</p> <p>However, each iteration allocates a struct smb_sid via kmalloc_obj() at the top of the loop and relies on the kfree(sid) call at the end of the loop body (the &#39;pass_same_sid&#39; label in the first loop, and the explicit kfree at the tail of the second loop) to release it. The newly introduced &#39;break&#39; statements bypass those kfree() calls, leaking the sid buffer every time an overflow is detected.</p> <p>A malicious or malformed file with enough POSIX ACL entries to trip the overflow check will leak one or more struct smb_sid allocations on every request that touches the file&#39;s DACL, providing a trivial kernel memory exhaustion vector.</p> <p>Free sid before breaking out of the loops to plug the leak.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-64139 https://cve.radiocsirt.org/vuln/ghsa-3c28-w5w6-mh56 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow</p> <p>Commit 299f962c0b02 (&#34;ksmbd: use check_add_overflow() to prevent u16 DACL size overflow&#34;) added check_add_overflow() guards that break out of the ACE-building loops in set_posix_acl_entries_dacl() when the accumulated DACL size would wrap past 65535.</p> <p>However, each iteration allocates a struct smb_sid via kmalloc_obj() at the top of the loop and relies on the kfree(sid) call at the end of the loop body (the &#39;pass_same_sid&#39; label in the first loop, and the explicit kfree at the tail of the second loop) to release it. The newly introduced &#39;break&#39; statements bypass those kfree() calls, leaking the sid buffer every time an overflow is detected.</p> <p>A malicious or malformed file with enough POSIX ACL entries to trip the overflow check will leak one or more struct smb_sid allocations on every request that touches the file&#39;s DACL, providing a trivial kernel memory exhaustion vector.</p> <p>Free sid before breaking out of the loops to plug the leak.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow</p> <p>Commit 299f962c0b02 (&#34;ksmbd: use check_add_overflow() to prevent u16 DACL size overflow&#34;) added check_add_overflow() guards that break out of the ACE-building loops in set_posix_acl_entries_dacl() when the accumulated DACL size would wrap past 65535.</p> <p>However, each iteration allocates a struct smb_sid via kmalloc_obj() at the top of the loop and relies on the kfree(sid) call at the end of the loop body (the &#39;pass_same_sid&#39; label in the first loop, and the explicit kfree at the tail of the second loop) to release it. The newly introduced &#39;break&#39; statements bypass those kfree() calls, leaking the sid buffer every time an overflow is detected.</p> <p>A malicious or malformed file with enough POSIX ACL entries to trip the overflow check will leak one or more struct smb_sid allocations on every request that touches the file&#39;s DACL, providing a trivial kernel memory exhaustion vector.</p> <p>Free sid before breaking out of the loops to plug the leak.</p> https://cve.radiocsirt.org/vuln/ghsa-3c28-w5w6-mh56 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-64139 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 108 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow Commit 299f962c0b02 (&#34;ksmbd: use check_add_overflow() to prevent u16 DACL size overflow&#34;) added check_add_overflow() guards that break out of the ACE-building loops in set_posix_acl_entries_dacl() when the accumulated DACL size would wrap past 65535. However, each iteration allocates a struct smb_sid via kmalloc_obj() at the top of the loop and relies on the kfree(sid) call at the end of the loop body (the &#39;pass_same_sid&#39; label in the first loop, and the explicit kfree at the tail of the second loop) to release it. The newly introduced &#39;break&#39; statements bypass those kfree() calls, leaking the sid buffer every time an overflow is detected. A malicious or malformed file with enough POSIX ACL entries to trip the overflow check will leak one or more struct smb_sid allocations on every request that touches the file&#39;s DACL, providing a trivial kernel memory exhaustion vector. Free sid before breaking out of the loops to plug the leak.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 108 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow Commit 299f962c0b02 (&#34;ksmbd: use check_add_overflow() to prevent u16 DACL size overflow&#34;) added check_add_overflow() guards that break out of the ACE-building loops in set_posix_acl_entries_dacl() when the accumulated DACL size would wrap past 65535. However, each iteration allocates a struct smb_sid via kmalloc_obj() at the top of the loop and relies on the kfree(sid) call at the end of the loop body (the &#39;pass_same_sid&#39; label in the first loop, and the explicit kfree at the tail of the second loop) to release it. The newly introduced &#39;break&#39; statements bypass those kfree() calls, leaking the sid buffer every time an overflow is detected. A malicious or malformed file with enough POSIX ACL entries to trip the overflow check will leak one or more struct smb_sid allocations on every request that touches the file&#39;s DACL, providing a trivial kernel memory exhaustion vector. Free sid before breaking out of the loops to plug the leak.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-64139 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2403 <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, möglicherweise Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen oder vertrauliche Informationen offenzulegen.</p> <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, möglicherweise Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen oder vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2403