CVE-2026-99110

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix heap overflow in cifs do set acl()

cifs set acl() validates ACL size using posix acl xattr size():

4 + (count * 8) // 4-byte header + 8 bytes per ACE

cifs do set acl() then calls posix acl to cifs() to write the CIFS wire format into the same buffer:

6 + (count * 10) // 6-byte header + 10 bytes per ACE

An ACL that passes the xattr-based check in cifs set acl() can overflow the heap when posix acl to cifs() writes the larger CIFS format.

Validate the CIFS format size against the remaining buffer space and USHRT MAX before converting--data count is u16, so sizes above USHRT MAX truncate the on-wire packet length, causing the server to apply a partial ACL. Replace MaxDataCount = 1000 with min(CIFSMaxBufSize, USHRT MAX).