CVE-2026-97554
Received Received - Intake

Linux Kernel SID Parsing Memory Leak

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() cifs_posix_to_fattr() ignores the return value of posix_info_parse(). When a malformed POSIX directory entry is encountered (e.g. invalid SID lengths from an untrusted server), posix_info_parse() returns -1 without populating the 'parsed' struct. The uninitialized stack memory in parsed.owner and parsed.group is then passed to sid_to_id(), which processes the garbage bytes and passes them to request_key() to construct a SID string, potentially leaking kernel stack contents to the userspace idmap daemon. Fix this by checking the return value and skipping the SID-to-id mapping when parsing fails. The remaining fattr fields (timestamps, mode, etc.) are populated directly from the 'info' pointer so they are unaffected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97554
EUVD
EUVD-2026-86862

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a function called cifs_posix_to_fattr() which fails to check the return value of posix_info_parse(). When a malformed POSIX directory entry is encountered, uninitialized memory from the stack is used to construct SID strings, potentially leaking kernel stack contents to userspace.

Detection Guidance

This vulnerability is specific to the Linux kernel's CIFS client implementation and involves improper handling of malformed POSIX directory entries. Detection requires examining kernel logs for errors related to SID parsing or cifs_posix_to_fattr() failures. Check for kernel messages indicating uninitialized SID usage or invalid SID lengths from SMB servers.

Impact Analysis

This vulnerability could allow an attacker to leak sensitive kernel memory contents to userspace, potentially exposing confidential information. It may also lead to system instability or crashes if corrupted data is processed.

Mitigation Strategies

Apply the Linux kernel patch that fixes the issue in cifs_posix_to_fattr(). Update to a kernel version containing the fix. If immediate patching is not possible, restrict access to untrusted SMB servers or disable CIFS client features until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97554. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart