CVE-2026-97559
Received Received - Intake

Buffer Overflow in Linux Kernel SMB Client

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: fail DACL rewrite when the new DACL exceeds 64K replace_sids_and_copy_aces() and set_chmod_dacl() accumulate the size of the DACL they build in a u16. That accumulator can wrap. validate_dacl() caps num_aces at (dacl_size - sizeof(struct smb_acl)) / 20, i.e. 3276 for a maximally sized DACL, while each rewritten ACE can grow to sizeof(struct smb_ace) (76 bytes) once its SID is replaced with one carrying SID_MAX_SUB_AUTHORITIES sub-authorities. The worst case is therefore sizeof(struct smb_acl) + 3276 * 76 = 248984 bytes, far beyond what a u16 can hold. A wraparound is reached with 863 ACEs. After the wraparound, ndacl_ptr->size becomes meaningless and the offset will point anywhere in the ACE array. As a result, we will see corruption of the DACL, which then gets sent to the server. This is not an out-of-bounds write as the allocation now covers the worst-case expansion, so writes will always go into the buffer. Adjust the code to use a u32 internally and return -EOVERFLOW in the overflow case. The operation must be refused, because a DACL can only hold 2^16-1 bytes on the wire and larger DACLs cannot be represented. set_chmod_dacl() carries the same pattern and is fixed the same way. It only wraps once the source DACL comes within roughly 380 bytes of the 64K ceiling, but the failure mode is identical.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97559
EUVD
EUVD-2026-86867

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a buffer overflow risk in the SMB client when rewriting file permissions. The issue occurs because two functions use a 16-bit integer to track the size of a rewritten file permission list (DACL), which can overflow if the list grows too large. When the overflow happens, the system writes corrupted permission data to the server, potentially causing security issues.

Detection Guidance

This vulnerability is specific to the Linux kernel's SMB client implementation and may not have direct detection commands. Monitor for DACL corruption errors in kernel logs or SMB client operations. Check for failed DACL rewrite attempts or unexpected ACE growth in smbclient operations.

Impact Analysis

If exploited, this vulnerability could allow an attacker to corrupt file permissions on a remote SMB server by sending specially crafted requests. This might lead to unauthorized access to files or directories, data leaks, or system instability. Users relying on SMB for file sharing could face security risks.

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized access to sensitive data stored on SMB servers, violating confidentiality requirements in GDPR and HIPAA. Organizations using Linux systems with SMB clients may fail to protect personal or health data adequately, risking legal penalties and reputational damage.

Mitigation Strategies

Apply the Linux kernel patch that fixes this issue. Update to a kernel version containing the fix for replace_sids_and_copy_aces() and set_chmod_dacl() overflow handling. Avoid manual DACL modifications that could trigger the wraparound condition until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97559. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart