{"id":"CVE-2026-97555","published":"2026-09-25T11:17:05.963","lastModified":"2026-09-25T15:17:58.803","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix heap overflow in DACL owner/group rewrite\n\nWhen id_mode_to_cifs_acl rewrites an existing DACL, it allocates a\nbuffer sized according to the on-disk DACL length reported by\ndacl_ptr->size. However, replace_sids_and_copy_aces may rewrite each\nACE with a new owner/group SID obtained from the cifs.idmap upcall.\nThose SIDs can have up to SID_MAX_SUB_AUTHORITIES (15) sub-authorities,\nmaking each ACE up to 76 bytes (sizeof(struct smb_ace)).\n\nIf the original DACL contains short SIDs (e.g., 1 sub-authority) while\nthe replacement SIDs are long, the rewritten ACEs overflow the\nallocation.\n\nFix this by always budgeting for worst-case SID expansion: allocate\nsizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), which\ncovers the smb_acl header and room for every ACE at maximum SID size.\nThis replaces the previous split logic that used dacl_ptr->size for\ncifsacl mounts but num_aces * sizeof(struct smb_ace) for mode_from_sid\nmounts: both paths can trigger the same rewrite and need the same\nheadroom.\n\nKASAN reports this as:\n  BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x1e8a/0x2680 [cifs]\n  Write of size 4 at addr ffff8881a5e25374 by task chown/5298\n  ...\n  The buggy address is located 0 bytes to the right of\n   allocated 884-byte region [ffff8881a5e25000, ffff8881a5e25374)","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/0ee150794c75bcd0be0e24ff3394f433cbae18cc","tags":[]},{"url":"https://git.kernel.org/stable/c/2a9aee9ef5622d58d8aafaa3263b3ffe70e2d9dd","tags":[]},{"url":"https://git.kernel.org/stable/c/7fa84c9ca690643f429ae2709584a47e74b572c9","tags":[]},{"url":"https://git.kernel.org/stable/c/fb736ab4fb8c4fdb8b2f9ccd3a62e03d11549ca1","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw is a heap overflow vulnerability in the Linux kernel's SMB client implementation, specifically in the handling of DACLs (Discretionary Access Control Lists). This can lead to buffer overflows when rewriting SIDs (Security Identifiers) in DACL entries, potentially allowing an attacker to execute arbitrary code or cause a denial of service.","exploitability":"Exploitation requires an attacker to send specially crafted SMB requests that rewrite DACLs with longer SIDs than the original. This is moderately difficult and requires the attacker to have the ability to modify SMB traffic to the affected system.","blast_radius":"If exploited, this vulnerability could allow an attacker to execute arbitrary code with kernel privileges or cause a denial of service condition, impacting the system's stability and security.","remediation":"Upgrade to the fixed version 5.19.10 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["heap-overflow","smb","kernel","dacf","privilege-escalation"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-29T09:05:10.785Z"}}