CVE-2026-97555

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix heap overflow in DACL owner/group rewrite

When id_mode_to_cifs_acl rewrites an existing DACL, it allocates a

buffer sized according to the on-disk DACL length reported by

dacl_ptr->size. However, replace_sids_and_copy_aces may rewrite each

ACE with a new owner/group SID obtained from the cifs.idmap upcall.

Those SIDs can have up to SID_MAX_SUB_AUTHORITIES (15) sub-authorities,

making each ACE up to 76 bytes (sizeof(struct smb_ace)).

If the original DACL contains short SIDs (e.g., 1 sub-authority) while

the replacement SIDs are long, the rewritten ACEs overflow the

allocation.

Fix this by always budgeting for worst-case SID expansion: allocate

sizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), which

covers the smb_acl header and room for every ACE at maximum SID size.

This replaces the previous split logic that used dacl_ptr->size for

cifsacl mounts but num_aces * sizeof(struct smb_ace)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References