CVE-2026-97555

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A heap overflow exists in the SMB client when rewriting a Discretionary Access Control List (DACL). The issue occurs in the id mode to cifs acl function, which allocates a buffer based on the on-disk DACL length reported by dacl ptr->size. When the replace sids and copy aces function replaces existing Security Identifiers (SIDs) with new owner or group SIDs from the cifs.idmap upcall, the new SIDs may be longer than the originals. Since SIDs can have up to 15 sub-authorities, each Access Control Entry (ACE) can reach 76 bytes. If the original DACL contains short SIDs and the replacements are long, the rewritten ACEs overflow the allocated buffer. This was identified via KASAN as a slab-out-of-bounds write in the build sec desc() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.