CVE-2026-97555 (GCVE-0-2026-97555)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:21 – Updated: 2026-09-25 14:41
VLAI
Title
smb: client: fix heap overflow in DACL owner/group rewrite
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When id_mode_to_cifs_acl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by dacl_ptr->size. However, replace_sids_and_copy_aces may rewrite each ACE with a new owner/group SID obtained from the cifs.idmap upcall. Those SIDs can have up to SID_MAX_SUB_AUTHORITIES (15) sub-authorities, making each ACE up to 76 bytes (sizeof(struct smb_ace)). If the original DACL contains short SIDs (e.g., 1 sub-authority) while the replacement SIDs are long, the rewritten ACEs overflow the allocation. Fix this by always budgeting for worst-case SID expansion: allocate sizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), which covers the smb_acl header and room for every ACE at maximum SID size. This replaces the previous split logic that used dacl_ptr->size for cifsacl mounts but num_aces * sizeof(struct smb_ace) for mode_from_sid mounts: both paths can trigger the same rewrite and need the same headroom. KASAN reports this as: BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x1e8a/0x2680 [cifs] Write of size 4 at addr ffff8881a5e25374 by task chown/5298 ... The buggy address is located 0 bytes to the right of allocated 884-byte region [ffff8881a5e25000, ffff8881a5e25374)
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 , < fb736ab4fb8c4fdb8b2f9ccd3a62e03d11549ca1 (git)
Affected: bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 , < 7fa84c9ca690643f429ae2709584a47e74b572c9 (git)
Affected: bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 , < 2a9aee9ef5622d58d8aafaa3263b3ffe70e2d9dd (git)
Affected: bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 , < 0ee150794c75bcd0be0e24ff3394f433cbae18cc (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.12
Unaffected: 0 , < 5.12 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2.7 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifsacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fb736ab4fb8c4fdb8b2f9ccd3a62e03d11549ca1",
              "status": "affected",
              "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4",
              "versionType": "git"
            },
            {
              "lessThan": "7fa84c9ca690643f429ae2709584a47e74b572c9",
              "status": "affected",
              "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4",
              "versionType": "git"
            },
            {
              "lessThan": "2a9aee9ef5622d58d8aafaa3263b3ffe70e2d9dd",
              "status": "affected",
              "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4",
              "versionType": "git"
            },
            {
              "lessThan": "0ee150794c75bcd0be0e24ff3394f433cbae18cc",
              "status": "affected",
              "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifsacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc3",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix heap overflow in DACL owner/group rewrite\n\nWhen id_mode_to_cifs_acl rewrites an existing DACL, it allocates a\nbuffer sized according to the on-disk DACL length reported by\ndacl_ptr-\u003esize. However, replace_sids_and_copy_aces may rewrite each\nACE with a new owner/group SID obtained from the cifs.idmap upcall.\nThose SIDs can have up to SID_MAX_SUB_AUTHORITIES (15) sub-authorities,\nmaking each ACE up to 76 bytes (sizeof(struct smb_ace)).\n\nIf the original DACL contains short SIDs (e.g., 1 sub-authority) while\nthe replacement SIDs are long, the rewritten ACEs overflow the\nallocation.\n\nFix this by always budgeting for worst-case SID expansion: allocate\nsizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), which\ncovers the smb_acl header and room for every ACE at maximum SID size.\nThis replaces the previous split logic that used dacl_ptr-\u003esize for\ncifsacl mounts but num_aces * sizeof(struct smb_ace) for mode_from_sid\nmounts: both paths can trigger the same rewrite and need the same\nheadroom.\n\nKASAN reports this as:\n  BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x1e8a/0x2680 [cifs]\n  Write of size 4 at addr ffff8881a5e25374 by task chown/5298\n  ...\n  The buggy address is located 0 bytes to the right of\n   allocated 884-byte region [ffff8881a5e25000, ffff8881a5e25374)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - chown/chgrp reaches id_mode_to_cifs_acl via cifs_setattr_nounix, which fetches the NTSD through get_smb2_acl \u2192 SMB2_query_acl (SMB2 QUERY_INFO, InfoType=SMB2_O_INFO_SECURITY). The DACL that undersizes the kzalloc (dacl_ptr-\u003esize and short ACE SIDs) is that response body from a remote SMB server on TCP/445.\nAC:L - After setattr hits id_mode_to_cifs_acl\u0027s chown branch, overflow is deterministic: the server returns 1-sub-authority owner ACEs so dacl_ptr-\u003esize is compact, while idsfromsid builds a 3-sub-authority S-1-5-88 SID and id_to_sid() can return up to 15, and replace_sids_and_copy_aces/cifs_copy_ace writes the expanded ACEs with no race.\nPR:N - The attacker is the SMB server answering SMB2_query_acl on the existing tree-connect and holds no uid, share credential, or capability on the client. Local chown_ok/CAP_CHOWN belongs to the victim who issues chown/chgrp, not to the server.\nUI:R - The overflowing allocation is only in id_mode_to_cifs_acl\u0027s ATTR_UID/ATTR_GID (chown/chgrp) branch from cifs_setattr_nounix, so a user must chown(2) or chgrp(2) a file on a cifsacl, modefromsid, or posix_extensions CIFS mount of the attacker\u0027s share; lookup/stat/read never rewrite that DACL.\nS:U - The overflow is of the kmalloc\u0027d pnntsd buffer inside id_mode_to_cifs_acl/build_sec_desc on the CIFS client host and stays in that kernel\u0027s own authority; it is not a VM, IOMMU, or sandbox escape.\nC:H - replace_sids_and_copy_aces heap-overflows pnntsd in build_sec_desc (KASAN slab-out-of-bounds write of expanded ACE/SID bytes). Corrupting neighboring slab objects is a kernel-memory disclosure primitive, so confidentiality is High.\nI:H - cifs_copy_ace writes server-chosen ACE type/flags/access_req and a longer SID past the end of id_mode_to_cifs_acl\u0027s kzalloc buffer, an out-of-bounds heap write that can corrupt adjacent objects and hijack control flow.\nA:H - The same out-of-bounds write in build_sec_desc was reported as KASAN slab-out-of-bounds by task chown and can oops or panic the client kernel, fully denying availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:12.900Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fb736ab4fb8c4fdb8b2f9ccd3a62e03d11549ca1"
        },
        {
          "url": "https://git.kernel.org/stable/c/7fa84c9ca690643f429ae2709584a47e74b572c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a9aee9ef5622d58d8aafaa3263b3ffe70e2d9dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ee150794c75bcd0be0e24ff3394f433cbae18cc"
        }
      ],
      "title": "smb: client: fix heap overflow in DACL owner/group rewrite",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97555",
    "datePublished": "2026-09-25T10:21:46.445Z",
    "dateReserved": "2026-09-24T16:01:01.154Z",
    "dateUpdated": "2026-09-25T14:41:12.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-97555",
      "date": "2026-09-28",
      "epss": "0.00524",
      "percentile": "0.42187"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-28T01:25:38.000Z",
      "cve": "CVE-2026-97555",
      "id": "msrc_CVE-2026-97555",
      "initial_release_date": "2026-09-28T00:23:47.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "smb: client: fix heap overflow in DACL owner/group rewrite",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-97555.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/cifsacl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "fb736ab4fb8c4fdb8b2f9ccd3a62e03d11549ca1",
                    "status": "affected",
                    "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7fa84c9ca690643f429ae2709584a47e74b572c9",
                    "status": "affected",
                    "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2a9aee9ef5622d58d8aafaa3263b3ffe70e2d9dd",
                    "status": "affected",
                    "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0ee150794c75bcd0be0e24ff3394f433cbae18cc",
                    "status": "affected",
                    "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/cifsacl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.12"
                  },
                  {
                    "lessThan": "5.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix heap overflow in DACL owner/group rewrite\n\nWhen id_mode_to_cifs_acl rewrites an existing DACL, it allocates a\nbuffer sized according to the on-disk DACL length reported by\ndacl_ptr-\u003esize. However, replace_sids_and_copy_aces may rewrite each\nACE with a new owner/group SID obtained from the cifs.idmap upcall.\nThose SIDs can have up to SID_MAX_SUB_AUTHORITIES (15) sub-authorities,\nmaking each ACE up to 76 bytes (sizeof(struct smb_ace)).\n\nIf the original DACL contains short SIDs (e.g., 1 sub-authority) while\nthe replacement SIDs are long, the rewritten ACEs overflow the\nallocation.\n\nFix this by always budgeting for worst-case SID expansion: allocate\nsizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), which\ncovers the smb_acl header and room for every ACE at maximum SID size.\nThis replaces the previous split logic that used dacl_ptr-\u003esize for\ncifsacl mounts but num_aces * sizeof(struct smb_ace) for mode_from_sid\nmounts: both paths can trigger the same rewrite and need the same\nheadroom.\n\nKASAN reports this as:\n  BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x1e8a/0x2680 [cifs]\n  Write of size 4 at addr ffff8881a5e25374 by task chown/5298\n  ...\n  The buggy address is located 0 bytes to the right of\n   allocated 884-byte region [ffff8881a5e25000, ffff8881a5e25374)"
          }
        ],
        "id": "CVE-2026-97555",
        "lastModified": "2026-09-25T15:17:58.803",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-25T11:17:05.963",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0ee150794c75bcd0be0e24ff3394f433cbae18cc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2a9aee9ef5622d58d8aafaa3263b3ffe70e2d9dd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7fa84c9ca690643f429ae2709584a47e74b572c9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fb736ab4fb8c4fdb8b2f9ccd3a62e03d11549ca1"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.