CVE-2026-93812

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93812", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-18T17:59:28.790Z", "datePublished": "2026-09-24T16:02:49.060Z", "dateUpdated": "2026-10-03T10:57:44.701Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-03T10:57:44.701Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr\n\nndr_encode_v4_ntacl() allocates sd_ndr.data via kzalloc() at entry.\nIf any subsequent ndr_write_*() call returns error during encoding,\nthe allocated sd_ndr.data won't be freed and causes memory leak.\n\nMove kfree(sd_ndr.data) into out label to ensure the buffer gets\nreleased on all success and error return paths."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/vfs.c"], "versions": [{"version": "303fff2b8c77a85c62dbde3b27c24b084144c04c", "lessThan": "306d6f370da7e0e5532dc51c972f4ce101e42431", "status": "affected", "versionType": "git"}, {"version": "303fff2b8c77a85c62dbde3b27c24b084144c04c", "lessThan": "dc55270e410ccb4d24e637c13b5c4c25bcd106d7", "status": "affected", "versionType": "git"}, {"version": "303fff2b8c77a85c62dbde3b27c24b084144c04c", "lessThan": "c866c3314a6853eb06c7a8bef67f43c8a8bdfb6e", "status": "affected", "versionType": "git"}, {"version": "303fff2b8c77a85c62dbde3b27c24b084144c04c", "lessThan": "9b4dec75498fd0a1c9eaea680aef59c9519eb16f", "status": "affected", "versionType": "git"}, {"version": "303fff2b8c77a85c62dbde3b27c24b084144c04c", "lessThan": "c521dd78e036b5e0cfd394dd2ff2218890dd9e41", "status": "affected", "versionType": "git"}, {"version": "303fff2b8c77a85c62dbde3b27c24b084144c04c", "lessThan": "d4d56b00c7df88cd5751e7415bdfabc9fdbc82a7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/vfs.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/306d6f370da7e0e5532dc51c972f4ce101e42431"}, {"url": "https://git.kernel.org/stable/c/dc55270e410ccb4d24e637c13b5c4c25bcd106d7"}, {"url": "https://git.kernel.org/stable/c/c866c3314a6853eb06c7a8bef67f43c8a8bdfb6e"}, {"url": "https://git.kernel.org/stable/c/9b4dec75498fd0a1c9eaea680aef59c9519eb16f"}, {"url": "https://git.kernel.org/stable/c/c521dd78e036b5e0cfd394dd2ff2218890dd9e41"}, {"url": "https://git.kernel.org/stable/c/d4d56b00c7df88cd5751e7415bdfabc9fdbc82a7"}], "title": "ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/server/vfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "306d6f370da7e0e5532dc51c972f4ce101e42431", "status": "affected", "version": "303fff2b8c77a85c62dbde3b27c24b084144c04c", "versionType": "git"}, {"lessThan": "dc55270e410ccb4d24e637c13b5c4c25bcd106d7", "status": "affected", "version": "303fff2b8c77a85c62dbde3b27c24b084144c04c", "versionType": "git"}, {"lessThan": "c866c3314a6853eb06c7a8bef67f43c8a8bdfb6e", "status": "affected", "version": "303fff2b8c77a85c62dbde3b27c24b084144c04c", "versionType": "git"}, {"lessThan": "9b4dec75498fd0a1c9eaea680aef59c9519eb16f", "status": "affected", "version": "303fff2b8c77a85c62dbde3b27c24b084144c04c", "versionType": "git"}, {"lessThan": "c521dd78e036b5e0cfd394dd2ff2218890dd9e41", "status": "affected", "version": "303fff2b8c77a85c62dbde3b27c24b084144c04c", "versionType": "git"}, {"lessThan": "d4d56b00c7df88cd5751e7415bdfabc9fdbc82a7", "status": "affected", "version": "303fff2b8c77a85c62dbde3b27c24b084144c04c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/server/vfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr\n\nndr_encode_v4_ntacl() allocates sd_ndr.data via kzalloc() at entry.\nIf any subsequent ndr_write_*() call returns error during encoding,\nthe allocated sd_ndr.data won't be freed and causes memory leak.\n\nMove kfree(sd_ndr.data) into out label to ensure the buffer gets\nreleased on all success and error return paths."}], "id": "CVE-2026-93812", "lastModified": "2026-10-03T11:17:50.993", "metrics": {}, "published": "2026-09-24T17:17:14.657", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/306d6f370da7e0e5532dc51c972f4ce101e42431"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9b4dec75498fd0a1c9eaea680aef59c9519eb16f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c521dd78e036b5e0cfd394dd2ff2218890dd9e41"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c866c3314a6853eb06c7a8bef67f43c8a8bdfb6e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d4d56b00c7df88cd5751e7415bdfabc9fdbc82a7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dc55270e410ccb4d24e637c13b5c4c25bcd106d7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr", "id": "2540410", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540410"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr\nndr_encode_v4_ntacl() allocates sd_ndr.data via kzalloc() at entry.\nIf any subsequent ndr_write_*() call returns error during encoding,\nthe allocated sd_ndr.data won't be freed and causes memory leak.\nMove kfree(sd_ndr.data) into out label to ensure the buffer gets\nreleased on all success and error return paths.", "A flaw was found in the Linux kernel's ksmbd (Server Message Block) server. A remote attacker could cause a denial of service (DoS) by triggering a kernel memory leak during security attribute operations. When an error occurs while encoding security descriptors, dynamically allocated memory is not freed on the failure path, gradually consuming system memory over time."], "name": "CVE-2026-93812", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93812\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93812\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93812.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9b4dec75498fd0a1c9eaea680aef59c9519eb16f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c521dd78e036b5e0cfd394dd2ff2218890dd9e41)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d4d56b00c7df88cd5751e7415bdfabc9fdbc82a7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.111)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-24T21:45:17.178077+00:00", "updated": "2026-10-01T20:00:12.417755+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}