From b08b254a81fccf7e904f46c4f68e380a8899f80d Mon Sep 17 00:00:00 2001 From: Alan Jowett Date: Tue, 19 May 2026 15:54:31 -0700 Subject: [PATCH] ebpf_platform: Add missing SeReleaseSubjectContext calls SeCaptureSubjectContext captures token references that must be released via SeReleaseSubjectContext. Both ebpf_access_check and ebpf_platform_get_authentication_id were missing this call, leaking kernel token object references on every invocation. Add SeReleaseSubjectContext on all return paths in both functions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- libs/runtime/kernel/ebpf_platform_kernel.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libs/runtime/kernel/ebpf_platform_kernel.c b/libs/runtime/kernel/ebpf_platform_kernel.c index e2a55fac2c..70e5540557 100644 --- a/libs/runtime/kernel/ebpf_platform_kernel.c +++ b/libs/runtime/kernel/ebpf_platform_kernel.c @@ -372,6 +372,7 @@ ebpf_access_check( } SeUnlockSubjectContext(&subject_context); + SeReleaseSubjectContext(&subject_context); return result; } @@ -411,6 +412,7 @@ _IRQL_requires_max_(PASSIVE_LEVEL) _Must_inspect_result_ ebpf_result_t if (access_token == NULL) { EBPF_LOG_MESSAGE(EBPF_TRACELOG_LEVEL_ERROR, EBPF_TRACELOG_KEYWORD_BASE, "SeQuerySubjectContextToken failed"); + SeReleaseSubjectContext(&context); return EBPF_FAILED; } @@ -419,11 +421,13 @@ _IRQL_requires_max_(PASSIVE_LEVEL) _Must_inspect_result_ ebpf_result_t if (!NT_SUCCESS(status)) { EBPF_LOG_NTSTATUS_API_FAILURE(EBPF_TRACELOG_KEYWORD_BASE, SeQueryAuthenticationIdToken, status); + SeReleaseSubjectContext(&context); return EBPF_FAILED; } *authentication_id = *(uint64_t*)&local_authentication_id; + SeReleaseSubjectContext(&context); return EBPF_SUCCESS; }