CVE-2026-97555

8.8 HIGH

Published 2026-09-25 · Updated 2026-09-25

AI risk analysis

Summary: The flaw is a heap overflow vulnerability in the Linux kernel's SMB client implementation, specifically in the handling of DACLs (Discretionary Access Control Lists). This can lead to buffer overflows when rewriting SIDs (Security Identifiers) in DACL entries, potentially allowing an attacker to execute arbitrary code or cause a denial of service.
Exploitability: Exploitation requires an attacker to send specially crafted SMB requests that rewrite DACLs with longer SIDs than the original. This is moderately difficult and requires the attacker to have the ability to modify SMB traffic to the affected system.
Blast radius: If exploited, this vulnerability could allow an attacker to execute arbitrary code with kernel privileges or cause a denial of service condition, impacting the system's stability and security.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to the fixed version 5.19.10 or later.

heap-overflowsmbkerneldacfprivilege-escalation

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When id_mode_to_cifs_acl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by dacl_ptr->size. However, replace_sids_and_copy_aces may rewrite each ACE with a new owner/group SID obtained from the cifs.idmap upcall. Those SIDs can have up to SID_MAX_SUB_AUTHORITIES (15) sub-authorities, making each ACE up to 76 bytes (sizeof(struct smb_ace)). If the original DACL contains short SIDs (e.g., 1 sub-authority) while the replacement SIDs are long, the rewritten ACEs overflow the allocation. Fix this by always budgeting for worst-case SID expansion: allocate sizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), which covers the smb_acl header and room for every ACE at maximum SID size. This replaces the previous split logic that used dacl_ptr->size for cifsacl mounts but num_aces * sizeof(struct smb_ace) for mode_from_sid mounts: both paths can trigger the same rewrite and need the same headroom. KASAN reports this as: BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x1e8a/0x2680 [cifs] Write of size 4 at addr ffff8881a5e25374 by task chown/5298 ... The buggy address is located 0 bytes to the right of allocated 884-byte region [ffff8881a5e25000, ffff8881a5e25374)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.