CVE-2026-97555

Received Received - Intake

BaseFortify

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When id_mode_to_cifs_acl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by dacl_ptr->size. However, replace_sids_and_copy_aces may rewrite each ACE with a new owner/group SID obtained from the cifs.idmap upcall. Those SIDs can have up to SID_MAX_SUB_AUTHORITIES (15) sub-authorities, making each ACE up to 76 bytes (sizeof(struct smb_ace)). If the original DACL contains short SIDs (e.g., 1 sub-authority) while the replacement SIDs are long, the rewritten ACEs overflow the allocation. Fix this by always budgeting for worst-case SID expansion: allocate sizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), which covers the smb_acl header and room for every ACE at maximum SID size. This replaces the previous split logic that used dacl_ptr->size for cifsacl mounts but num_aces * sizeof(struct smb_ace) for mode_from_sid mounts: both paths can trigger the same rewrite and need the same headroom. KASAN reports this as: BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x1e8a/0x2680 [cifs] Write of size 4 at addr ffff8881a5e25374 by task chown/5298 ... The buggy address is located 0 bytes to the right of allocated 884-byte region [ffff8881a5e25000, ffff8881a5e25374)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97555

EUVD

EUVD-2026-86863

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	bc3e9dd9d104ca1b75644eab87b38ce8a924aef4
Linux	Linux	bc3e9dd9d104ca1b75644eab87b38ce8a924aef4
Linux	Linux	bc3e9dd9d104ca1b75644eab87b38ce8a924aef4
Linux	Linux	bc3e9dd9d104ca1b75644eab87b38ce8a924aef4
Linux	Linux	bc3e9dd9d104ca1b75644eab87b38ce8a924aef4
Linux	Linux	5.12

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a heap overflow vulnerability in the Linux kernel's SMB client implementation. It occurs when rewriting file permissions (DACL) where the system incorrectly calculates buffer sizes for new security identifiers (SIDs). The issue arises because the code allocates memory based on the original SID size but then writes larger SIDs during the rewrite process, causing a buffer overflow.

Detection Guidance

This vulnerability may be detected by monitoring for heap overflow errors in the Linux kernel's CIFS/SMB client module. Check kernel logs for KASAN reports indicating slab-out-of-bounds errors in build_sec_desc or related CIFS functions. Use commands like dmesg | grep -i kasan or journalctl -k | grep -i cifs to search for such errors.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a system crash by triggering the heap overflow. It specifically affects systems using the CIFS/SMB protocol to access shared files, potentially leading to unauthorized access or denial of service on affected machines.

Compliance Impact

This vulnerability is a heap overflow in the Linux kernel's SMB client implementation that could allow unauthorized memory access. While not directly tied to GDPR or HIPAA, such vulnerabilities may lead to data breaches or unauthorized access to sensitive data, which could violate compliance requirements for protecting personal or health information.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that includes the fix for this CVE. Disable or restrict SMB client functionality if an update is not immediately available. Monitor vendor advisories for kernel updates addressing this issue.

Hi! I’m here to help you understand CVE-2026-97555. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70