CVE-2026-89638
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
When a file has the setuid or setgid bit set and is written to, the VFS strips those bits and issues a setattr with ATTR_KILL_SUID/ATTR_KILL_SGID together with an ATTR_MODE carrying the already-cleared mode.
Both cifs_setattr_unix() and cifs_setattr_nounix() unconditionally dropped ATTR_MODE in that case:
/* skip mode change if it's just for clearing setuid/setgid */ if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) attrs->ia_valid &= ~ATTR_MODE;
This is fine for the default mount, where the mode is only emulated via the DOS read-only attribute and cannot represent the setuid/setgid bits anyway. However, with the "cifsacl" or "modefromsid" mount options the mode is stored on the server through an ACL (id_mode_to_cifs_acl()), with the SMB3.1.1 POSIX extensions the mode is sent to the server directly, and with the SMB1 Unix extensions (cifs_setattr_unix) the mode is sent via CIFSSMBUnixSetPathInfo(). In all those cases dropping ATTR_MODE means the cleared mode is never pushed to the server, so the setuid/setgid bit survives the write.
This is a security issue: on local filesystems the setuid bit is stripped when a file is written, but over these cifs.ko mounts the bit persists on the server, potentially allowing an unexpected privilege escalation on subsequent execution.
Fix this in two places:
1. cifs_setattr_nounix(): only take the "skip mode change" shortcut when the mode is emulated via the DOS read-only attribute (i.e. neither cifsacl/modefromsid nor the SMB3.1.1 POSIX extensions are in effect), so that the cleared mode is propagated to the server in the ACL / POSIX cases.
2. cifs_setattr_unix(): this function is only called when Unix extensions are in effect, so the mode is always stored on the server. Remove the shortcut entirely so that the cleared mode is always pushed.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The Linux kernel's Common Internet File System (CIFS) client implementation contained a critical security flaw related to the handling of file permission attributes during write operations, specifically concerning setuid and setgid bits when advanced SMB extensions are active. Under standard POSIX semantics enforced by the Virtual File System (VFS), any modification to a file triggers an automatic stripping of the setuid and setgid privilege escalation bits to prevent unauthorized elevation of privileges. This behavior is mandated because allowing these bits to persist after content changes could enable attackers to exploit stale permissions for gaining root or elevated user access. The VFS correctly identifies this condition by setting ATTR_KILL_SUID and ATTR_KILL_SGID flags in the setattr structure, while simultaneously updating the mode field with the cleared permission values. However, the CIFS client code contained logic that inadvertently bypassed the transmission of these corrected permissions to the remote server under specific configuration scenarios.
The root cause lies in two functions within the CIFS module: cifs_setattr_nounix and cifs_setattr_unix. Both functions included a conditional check designed to optimize performance by skipping mode changes if the only modification was the removal of setuid or setgid bits, assuming that such changes were local-only emulations not requiring server-side updates. This optimization is valid for default CIFS mounts where file modes are merely simulated using DOS read-only attributes and do not reflect actual Unix-style permissions on the server. However, this logic failed to account for mount configurations utilizing cifsacl, modefromsid, or SMB3.1.1 POSIX extensions. In these scenarios, the file mode is either stored directly in ACLs sent via id_mode_to_cifs_acl or transmitted explicitly through SMB protocol commands like CIFSSMBUnixSetPathInfo. By unconditionally dropping ATTR_MODE from the attribute mask when setuid/setgid bits were being cleared, the client failed to send the updated permission state to the server. Consequently, while the local kernel view correctly reflected the stripped permissions, the remote file retained its original privileged mode bits.
This discrepancy creates a significant security vulnerability classified under CWE-250: Execution with Unnecessary Privileges and CWE-732: Incorrect Permission Assignment for Critical Resource. The persistence of setuid or setgid bits on the server allows an attacker who can write to such files to execute them later as root or another privileged user, effectively achieving privilege escalation that should have been prevented by standard file system security controls. This aligns with ATT&CK technique T1068: Exploitation for Privilege Escalation, where attackers leverage misconfigured permissions to gain higher-level access. The vulnerability is particularly dangerous because it exploits the trust boundary between local kernel enforcement and remote server state, leading to inconsistent security postures that can be reliably exploited in environments relying on these advanced SMB features for proper Unix permission mapping.
The resolution involves modifying both cifs_setattr_nounix and cifs_setattr_unix to ensure that cleared mode information is always propagated to the server when necessary. In cifs_setattr_nounix, the optimization shortcut was restricted so it only applies when neither cifsacl nor modefromsid extensions are active, ensuring that ACL-based permission updates include the corrected mode without setuid/setgid bits. For cifs_setattr_unix, which operates exclusively with Unix extensions enabled, the conditional check skipping mode changes was removed entirely. This guarantees that every write operation resulting in privilege bit removal sends the updated attributes to the server via CIFSSMBUnixSetPathInfo. These fixes restore consistency between local and remote permission states, ensuring that the security model enforced by the VFS is accurately reflected on the SMB share, thereby preventing potential privilege escalation attacks derived from stale or incorrect file permissions.