{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-97555","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-24T16:01:01.154Z","datePublished":"2026-09-25T10:21:46.445Z","dateUpdated":"2026-10-03T10:59:35.760Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-10-03T10:59:35.760Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix heap overflow in DACL owner/group rewrite\n\nWhen id_mode_to_cifs_acl rewrites an existing DACL, it allocates a\nbuffer sized according to the on-disk DACL length reported by\ndacl_ptr->size. However, replace_sids_and_copy_aces may rewrite each\nACE with a new owner/group SID obtained from the cifs.idmap upcall.\nThose SIDs can have up to SID_MAX_SUB_AUTHORITIES (15) sub-authorities,\nmaking each ACE up to 76 bytes (sizeof(struct smb_ace)).\n\nIf the original DACL contains short SIDs (e.g., 1 sub-authority) while\nthe replacement SIDs are long, the rewritten ACEs overflow the\nallocation.\n\nFix this by always budgeting for worst-case SID expansion: allocate\nsizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), which\ncovers the smb_acl header and room for every ACE at maximum SID size.\nThis replaces the previous split logic that used dacl_ptr->size for\ncifsacl mounts but num_aces * sizeof(struct smb_ace) for mode_from_sid\nmounts: both paths can trigger the same rewrite and need the same\nheadroom.\n\nKASAN reports this as:\n  BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x1e8a/0x2680 [cifs]\n  Write of size 4 at addr ffff8881a5e25374 by task chown/5298\n  ...\n  The buggy address is located 0 bytes to the right of\n   allocated 884-byte region [ffff8881a5e25000, ffff8881a5e25374)"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - chown/chgrp reaches id_mode_to_cifs_acl via cifs_setattr_nounix, which fetches the NTSD through get_smb2_acl → SMB2_query_acl (SMB2 QUERY_INFO, InfoType=SMB2_O_INFO_SECURITY). The DACL that undersizes the kzalloc (dacl_ptr->size and short ACE SIDs) is that response body from a remote SMB server on TCP/445.\nAC:L - After setattr hits id_mode_to_cifs_acl's chown branch, overflow is deterministic: the server returns 1-sub-authority owner ACEs so dacl_ptr->size is compact, while idsfromsid builds a 3-sub-authority S-1-5-88 SID and id_to_sid() can return up to 15, and replace_sids_and_copy_aces/cifs_copy_ace writes the expanded ACEs with no race.\nPR:N - The attacker is the SMB server answering SMB2_query_acl on the existing tree-connect and holds no uid, share credential, or capability on the client. Local chown_ok/CAP_CHOWN belongs to the victim who issues chown/chgrp, not to the server.\nUI:R - The overflowing allocation is only in id_mode_to_cifs_acl's ATTR_UID/ATTR_GID (chown/chgrp) branch from cifs_setattr_nounix, so a user must chown(2) or chgrp(2) a file on a cifsacl, modefromsid, or posix_extensions CIFS mount of the attacker's share; lookup/stat/read never rewrite that DACL.\nS:U - The overflow is of the kmalloc'd pnntsd buffer inside id_mode_to_cifs_acl/build_sec_desc on the CIFS client host and stays in that kernel's own authority; it is not a VM, IOMMU, or sandbox escape.\nC:H - replace_sids_and_copy_aces heap-overflows pnntsd in build_sec_desc (KASAN slab-out-of-bounds write of expanded ACE/SID bytes). Corrupting neighboring slab objects is a kernel-memory disclosure primitive, so confidentiality is High.\nI:H - cifs_copy_ace writes server-chosen ACE type/flags/access_req and a longer SID past the end of id_mode_to_cifs_acl's kzalloc buffer, an out-of-bounds heap write that can corrupt adjacent objects and hijack control flow.\nA:H - The same out-of-bounds write in build_sec_desc was reported as KASAN slab-out-of-bounds by task chown and can oops or panic the client kernel, fully denying availability."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/cifsacl.c"],"versions":[{"version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","lessThan":"d5cea6766ae1868a51c7d17d77d065b4f55c587f","status":"affected","versionType":"git"},{"version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","lessThan":"fb736ab4fb8c4fdb8b2f9ccd3a62e03d11549ca1","status":"affected","versionType":"git"},{"version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","lessThan":"7fa84c9ca690643f429ae2709584a47e74b572c9","status":"affected","versionType":"git"},{"version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","lessThan":"2a9aee9ef5622d58d8aafaa3263b3ffe70e2d9dd","status":"affected","versionType":"git"},{"version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","lessThan":"0ee150794c75bcd0be0e24ff3394f433cbae18cc","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/cifsacl.c"],"versions":[{"version":"5.12","status":"affected"},{"version":"0","lessThan":"5.12","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.6.158"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.12.111"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.18.53"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"7.2.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"7.3-rc3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/d5cea6766ae1868a51c7d17d77d065b4f55c587f"},{"url":"https://git.kernel.org/stable/c/fb736ab4fb8c4fdb8b2f9ccd3a62e03d11549ca1"},{"url":"https://git.kernel.org/stable/c/7fa84c9ca690643f429ae2709584a47e74b572c9"},{"url":"https://git.kernel.org/stable/c/2a9aee9ef5622d58d8aafaa3263b3ffe70e2d9dd"},{"url":"https://git.kernel.org/stable/c/0ee150794c75bcd0be0e24ff3394f433cbae18cc"}],"title":"smb: client: fix heap overflow in DACL owner/group rewrite","x_generator":{"engine":"bippy-1.2.0"}}}}