Look up another CVE · open CVE-2026-97555 in the interactive tracker
CVE-2026-97555
smb: client: fix heap overflow in DACL owner/group rewrite
Published 2026-09-25 (24 days ago) by the Linux kernel CNA. Subsystem fs/smb. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-97555 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.7-1 | Update the kernel and reboot. Fixed in 7.2.7-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.7-1 | Update the kernel and reboot. Fixed in 7.2.7-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
When id_mode_to_cifs_acl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by dacl_ptr->size. However, replace_sids_and_copy_aces may rewrite each ACE with a new owner/group SID obtained from the cifs.idmap upcall. Those SIDs can have up to SID_MAX_SUB_AUTHORITIES (15) sub-authorities, making each ACE up to 76 bytes (sizeof(struct smb_ace)). If the original DACL contains short SIDs (e.g., 1 sub-authority) while the replacement SIDs are long, the rewritten ACEs overflow the allocation. Fix this by always budgeting for worst-case SID expansion: allocate sizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), which covers the smb_acl header and room for every ACE at maximum SID size. This replaces the previous split logic that used dacl_ptr->size for cifsacl mounts but num_aces * sizeof(struct smb_ace) for mode_from_sid mounts: both paths can trigger the same rewrite and need the same headroom. KASAN reports this as: BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x1e8a/0x2680 [cifs] Write of size 4 at addr ffff8881a5e25374 by task chown/5298 ... The buggy address is located 0 bytes to the right of allocated 884-byte region [ffff8881a5e25000, ffff8881a5e25374)
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/smb/client/cifsacl.c
- What this is
- COMMON INTERNET FILE SYSTEM CLIENT (CIFS and SMB3)MAINTAINERS section matched on fs/smb/client/ · linux-cifs@vger.kernel.org · Supported
- Kernel module
- cifs
Check it on the machine
grep -wE 'CONFIG_CIFS|CONFIG_SMBFS' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w cifsPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sid, bookworm · linux-6.12m
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_CIFS, CONFIG_SMBFS
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-25 (24 days ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.52%, higher than 43.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/smb
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.12 | 6.6.158 | d5cea6766ae1 |
| 5.12 | 6.12.111 | fb736ab4fb8c |
| 5.12 | 6.18.53 | 7fa84c9ca690 |
| 5.12 | 7.2.7 | 2a9aee9ef562 |
| 5.12 | 7.3 | 0ee150794c75 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- chown/chgrp reaches id_mode_to_cifs_acl via cifs_setattr_nounix, which fetches the NTSD through get_smb2_acl → SMB2_query_acl (SMB2 QUERY_INFO, InfoType=SMB2_O_INFO_SECURITY). The DACL that undersizes the kzalloc (dacl_ptr->size and short ACE SIDs) is that response body from a remote SMB server on TCP/445.
- AC:LAttack complexity, low
- After setattr hits id_mode_to_cifs_acl's chown branch, overflow is deterministic: the server returns 1-sub-authority owner ACEs so dacl_ptr->size is compact, while idsfromsid builds a 3-sub-authority S-1-5-88 SID and id_to_sid() can return up to 15, and replace_sids_and_copy_aces/cifs_copy_ace writes the expanded ACEs with no race.
- PR:NPrivileges required, none
- The attacker is the SMB server answering SMB2_query_acl on the existing tree-connect and holds no uid, share credential, or capability on the client. Local chown_ok/CAP_CHOWN belongs to the victim who issues chown/chgrp, not to the server.
- UI:RUser interaction, required
- The overflowing allocation is only in id_mode_to_cifs_acl's ATTR_UID/ATTR_GID (chown/chgrp) branch from cifs_setattr_nounix, so a user must chown(2) or chgrp(2) a file on a cifsacl, modefromsid, or posix_extensions CIFS mount of the attacker's share; lookup/stat/read never rewrite that DACL.
- S:UScope, unchanged
- The overflow is of the kmalloc'd pnntsd buffer inside id_mode_to_cifs_acl/build_sec_desc on the CIFS client host and stays in that kernel's own authority; it is not a VM, IOMMU, or sandbox escape.
- C:HConfidentiality impact, high
- replace_sids_and_copy_aces heap-overflows pnntsd in build_sec_desc (KASAN slab-out-of-bounds write of expanded ACE/SID bytes). Corrupting neighboring slab objects is a kernel-memory disclosure primitive, so confidentiality is High.
- I:HIntegrity impact, high
- cifs_copy_ace writes server-chosen ACE type/flags/access_req and a longer SID past the end of id_mode_to_cifs_acl's kzalloc buffer, an out-of-bounds heap write that can corrupt adjacent objects and hijack control flow.
- A:HAvailability impact, high
- The same out-of-bounds write in build_sec_desc was reported as KASAN slab-out-of-bounds by task chown and can oops or panic the client kernel, fully denying availability.