CVE-2026-97555 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix heap overflow in DACL owner/group rewrite
When id_mode_to_cifs_acl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by dacl_ptr->size. However, replace_sids_and_copy_aces may rewrite each ACE with a new owner/group SID obtained from the cifs.idmap upcall. Those SIDs can have up to SID_MAX_SUB_AUTHORITIES (15) sub-authorities, making each ACE up to 76 bytes (sizeof(struct smb_ace)).
If the original DACL contains short SIDs (e.g., 1 sub-authority) while the replacement SIDs are long, the rewritten ACEs overflow the allocation.
Fix this by always budgeting for worst-case SID expansion: allocate sizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), which covers the smb_acl header and room for every ACE at maximum SID size. This replaces the previous split logic that used dacl_ptr->size for cifsacl mounts but num_aces * sizeof(struct smb_ace) for mode_from_sid mounts: both paths can trigger the same rewrite and need the same headroom.
KASAN reports this as: BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x1e8a/0x2680 [cifs]
Write of size 4 at addr ffff8881a5e25374 by task chown/5298 ... The buggy address is located 0 bytes to the right of allocated 884-byte region [ffff8881a5e25000, ffff8881a5e25374)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel's Common Internet File System (CIFS) client implementation contains a critical heap buffer overflow vulnerability within the Discretionary Access Control List rewriting logic. This flaw arises during the process of mapping Windows Security Identifiers to local user and group identifiers via the cifs.idmap upcall mechanism. When an application attempts to change file ownership or permissions on a CIFS-mounted filesystem, the kernel invokes id_mode_to_cifs_acl to reconstruct the security descriptor. The function initially allocates a memory buffer based on the size of the existing DACL as reported by the server in dacl_ptr->size. This approach assumes that the rewritten Access Control Entries will not exceed their original footprint, which is a dangerous assumption given the variable length nature of Security Identifiers.
The technical root cause lies in the disparity between short and long SIDs within Windows security models. A SID can contain up to fifteen sub-authorities, making each ACE potentially as large as seventy-six bytes when fully expanded with maximum-length identifiers. If the original DACL on the server utilizes compact or short-form SIDs that occupy less space than their full potential size, but the local idmap resolution results in longer, more complex SIDs being written back to the client-side buffer, the allocated memory region becomes insufficient. The replace_sids_and_copy_aces function proceeds to write these expanded ACEs into the pre-allocated buffer without verifying if there is adequate space remaining. This leads to a slab-out-of-bounds heap overflow where writes extend beyond the boundaries of the allocated kernel memory region.
The operational impact of this vulnerability is severe, as it allows for potential arbitrary code execution or system instability through kernel memory corruption. The Kernel Address Sanitizer (KASAN) has confirmed this issue by detecting out-of-bounds write operations triggered during chown operations on affected mounts. Specifically, KASAN reports a slab-out-of-bounds error where writes occur immediately adjacent to the allocated region, indicating that the overflow is precise and exploitable under specific conditions involving SID length mismatches between the server's stored ACLs and the client's resolved identifiers. Such memory corruption can lead to privilege escalation if an attacker can control the contents written into the overwritten kernel heap space, potentially allowing them to execute arbitrary code with root privileges or cause a denial of service by crashing the kernel.
This vulnerability is classified under CWE-122, which denotes a heap-based buffer overflow, and aligns with ATT&CK techniques related to privilege escalation via memory corruption exploits like T1068. The fix implemented in the Linux kernel addresses this flaw by abandoning the reliance on the server-reported DACL size for allocation purposes. Instead, the code now budgets for the worst-case scenario by allocating a buffer sized as sizeof(struct smb_acl) plus num_aces multiplied by sizeof(struct smb_ace). This ensures that every ACE has room to expand to its maximum possible SID length regardless of the original structure on disk. By unifying the allocation logic across both cifsacl and mode_from_sid mount types, the patch eliminates the split-path inconsistency that previously allowed this overflow condition to persist in certain configuration scenarios. System administrators should apply kernel updates containing this fix immediately to mitigate the risk of remote or local exploitation through file permission changes on CIFS shares.