Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-97555— smb: client: fix heap overflow in DACL owner/group rewrite

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已解决以下漏洞： smb: 客户端：修复 DACL 所有者/组重写时的堆缓冲区溢出 当 重写现有的 DACL（离散访问控制列表）时，它会根据 报告的磁盘 DACL 长度分配缓冲区。然而， 函数可能会用从 上行调用（upcall）获取的新所有者/组 SID（安全标识符）重新编写每个 ACE（访问控制条目）。这些新 SID 最多可包含 （15 个子权限），使得每个 ACE 最多可达 76 字节（ ）。 如果原始 DACL 中包含短 SID（例如仅 1 个子权限），而替换用的 SID 较长，则重写

CVSS 8.8 · High EPSS 0.52% · P42

Possible ATT&CK Techniques 1 AI

T1055 · Process Injection

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux bc3e9dd9d104ca1b75644eab87b38ce8a924aef4< fb736ab4fb8c4fdb8b2f9ccd3a62e03d11549ca1 affected
bc3e9dd9d104ca1b75644eab87b38ce8a924aef4< 7fa84c9ca690643f429ae2709584a47e74b572c9 affected
bc3e9dd9d104ca1b75644eab87b38ce8a924aef4< 2a9aee9ef5622d58d8aafaa3263b3ffe70e2d9dd affected
bc3e9dd9d104ca1b75644eab87b38ce8a924aef4< 0ee150794c75bcd0be0e24ff3394f433cbae18cc affected
5.12 affected
< 5.12 unaffected
6.12.111≤ 6.12.* unaffected
6.18.53≤ 6.18.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-97555

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
smb: client: fix heap overflow in DACL owner/group rewrite
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When id_mode_to_cifs_acl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by dacl_ptr->size. However, replace_sids_and_copy_aces may rewrite each ACE with a new owner/group SID obtained from the cifs.idmap upcall. Those SIDs can have up to SID_MAX_SUB_AUTHORITIES (15) sub-authorities, making each ACE up to 76 bytes (sizeof(struct smb_ace)). If the original DACL contains short SIDs (e.g., 1 sub-authority) while the replacement SIDs are long, the rewritten ACEs overflow the allocation. Fix this by always budgeting for worst-case SID expansion: allocate sizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), which covers the smb_acl header and room for every ACE at maximum SID size. This replaces the previous split logic that used dacl_ptr->size for cifsacl mounts but num_aces * sizeof(struct smb_ace) for mode_from_sid mounts: both paths can trigger the same rewrite and need the same headroom. KASAN reports this as: BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x1e8a/0x2680 [cifs] Write of size 4 at addr ffff8881a5e25374 by task chown/5298 ... The buggy address is located 0 bytes to the right of allocated 884-byte region [ffff8881a5e25000, ffff8881a5e25374)
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 ~ fb736ab4fb8c4fdb8b2f9ccd3a62e03d11549ca1 -
Linux Linux 5.12 -

II. Public POCs for CVE-2026-97555

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-97555

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-97555 (4)

Same Patch Batch · Linux · 2026-09-25 · 372 CVEs total

CVE-2026-100075 9.8 CRITICAL RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
CVE-2026-97957 8.8 HIGH net: hinic: fix mailbox segment buffer overflow
CVE-2026-97527 8.8 HIGH scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
CVE-2026-97528 8.8 HIGH scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
CVE-2026-98115 8.8 HIGH ksmbd: safely drain sessions during logoff
CVE-2026-97525 8.2 HIGH x86/mm/pat: Allocate split page tables as kernel page tables
CVE-2026-98130 8.1 HIGH sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START
CVE-2026-97573 8.1 HIGH bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()
CVE-2026-98069 8.1 HIGH net/rds: acquire the fastpath locks in rds_conn_shutdown()
CVE-2026-98070 8.1 HIGH net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
CVE-2026-97570 8.1 HIGH bnxt_en: Bound SW TPA IDs to prevent crashes
CVE-2026-97911 7.8 HIGH accel: ethosu: Ensure SRAM region size matches job
CVE-2026-98023 7.8 HIGH vxlan: reject dynamic fdb entries that reference a nexthop id
CVE-2026-97910 7.8 HIGH ASoC: sprd: validate compress buffer sizes against fixed allocations
CVE-2026-98143 7.8 HIGH accel: ethosu: Don't read the U65 rounding mode as a storage mode
CVE-2026-97903 7.8 HIGH exit: hold a reference to thread_pid across proc_flush_pid
CVE-2026-97548 7.8 HIGH xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions
CVE-2026-97602 7.8 HIGH inet: frags: invalidate queues before flushing them
CVE-2026-98073 7.8 HIGH net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().
CVE-2026-97612 7.8 HIGH net: mpls: clear inner_protocol when the last label is popped

Showing top 20 of 372 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-97555

No comments yet

Leave a comment