CVE-2026-97555

Executive Summary

CVE-2026-97555 is a heap out-of-bounds write in the Linux kernel CIFS/SMB client's ACL handling code, specifically in the DACL owner/group rewrite path (id_mode_to_cifs_acl / replace_sids_and_copy_aces / build_sec_desc). When a DACL is rewritten with replacement owner or group SIDs sourced from the cifs.idmap upcall, ACEs can grow up to 76 bytes each (maximum 15 sub-authorities), overrunning a buffer sized only to the original on-disk DACL length. Exploitation requires local interaction with CIFS-mounted filesystems and the CIFS id-mapping (cifs.idmap) service being reachable, and the impact is memory corruption in kernel context with potential privilege escalation or denial of service.

Technical Analysis

The vulnerability is a classic size-calculation mismatch in the Linux kernel CIFS client. The NVD description states that id_mode_to_cifs_acl allocates a buffer sized according to the on-disk DACL length reported by dacl_ptr->size. That sizing assumption is invalid when replace_sids_and_copy_aces rewrites each access control entry (ACE) with a new owner/group SID obtained from the cifs.idmap upcall. SIDs can carry up to SID_MAX_SUB_AUTHORITIES (15) sub-authorities, making each ACE up to 76 bytes (sizeof(struct smb_ace)). When the original DACL contains short SIDs (e.g., a single sub-authority) but the replacement SIDs are long, the rewritten ACEs exceed the allocation and overflow into adjacent heap memory.

The fix, per the description, is to always budget for worst-case SID expansion: allocate sizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), covering the SMB ACL header and maximum-sized ACEs for every access control entry. This corrects a prior split allocation strategy that used dacl_ptr->size for cifsacl mounts but num_aces * sizeof(struct smb_ace) for mode_from_sid mounts; both paths invoke the same rewrite logic and therefore require identical headroom.

KASAN instruments the overflow as:

• BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x1e8a/0x2680 [cifs]
• Write of size 4 at addr ffff8881a5e25374 by task chown/5298
• The buggy address is located 0 bytes to the right of an allocated 884-byte region [ffff8881a5e25000, ffff8881a5e25374)

The attack surface is the kernel CIFS client ACL-rewriting path, reachable when a user triggers a DACL rewrite on a CIFS/SMB-mounted share that enforces ownership/group substitution via id-mapping. The heap write is 4 bytes past the end of the allocation at the reported site, but the structural cause (unbounded per-ACE expansion) means the overflow magnitude scales with the number and length of replacement SIDs, not a fixed 4-byte overrun.

Note: additional attributes of the affected kernel versions, upcall transport, and precise cifs.idmap request mechanics are not specified in the available data; the analysis above is limited to what the description states.

Exploitation Scenarios

No public PoC or exploit code exists for CVE-2026-97555 (POC_STATUS: None; Nuclei template: NO; exploit code: NO). The attack chain below is inferred from the vulnerability class and the described code path; no specific implementation details are fabricated.

1. Reconnaissance / target identification: An attacker establishes that a target host has a CIFS/SMB share mounted with ACL handling active and the cifs.idmap upcall service available. Because the flaw is in the client-side kernel CIFS code, the relevant surface is a Linux system interacting with a CIFS server, not the server alone. The attacker's position is typically local, or a context that can cause the local DACL rewrite to run (e.g., via file operations that trigger ownership/group changes, as the KASAN trace shows task chown/5298).

2. Triggering the specific flaw class: The attacker arranges for a DACL rewrite on a CIFS-mounted file or directory whose existing DACL contains short SIDs while the mapped owner/group SIDs are long (up to 15 sub-authorities). Because the buffer is sized to dacl_ptr->size (the original on-disk DACL length), the rewritten ACEs exceed the allocation. The class of bug is an out-of-bounds heap write caused by trusting an on-disk length instead of the post-rewrite length.

3. Payload / execution method (class level): No specific payload is described. At the vulnerability class level, an attacker who can influence the SID content returned by the cifs.idmap upcall — or can select a DACL whose replacement SIDs are longer than the original SIDs — causes the kernel to write ACE data past the allocated region. The KASAN report indicates a 4-byte write beyond a 884-byte allocation at the reported site.

4. Post-exploitation impact: Successful corruption of kernel heap memory adjacent to the ACL buffer can lead to kernel memory corruption, which in the kernel context may result in denial of service (crash) and potentially privilege escalation (T1068). The available data does not confirm code-execution primitives, exploit reliability, or specific targeted objects; those remain unproven.

Impact Assessment

• Confidentiality: Potential — heap out-of-bounds write in kernel context can corrupt adjacent data. The data does not confirm direct information disclosure.
• Integrity: High — uncontrolled write in kernel memory can corrupt kernel heap structures.
• Availability: High — the KASAN trace demonstrates a crash-class condition (slab-out-of-bounds), indicating denials of service are achievable.
• Blast radius: Any Linux system running the affected CIFS client code and triggering the described DACL rewrite path (e.g., cifsacl or mode_from_sid mounts with active id-mapping). Local scope, kernel-wide impact on a host.
• CVSS: Not scored in provided data (N/A). No EPSS score is available; FIRST.org has not yet assigned one. CISA KEV: No. No exploit code or Nuclei template is available. No affected-version list is provided, so the vulnerable version window cannot be stated.

Detection Guidance

The rules below are detection heuristics for the described behavior (KASAN slab-out-of-bounds in the CIFS client, DACL/SID rewrite activity, and id-mapping). They are not derived from a public PoC, which does not exist. Tune to environment and validate before production use.

Sigma Rule

title: Potential Linux CIFS Client DACL/SID Rewrite Heap Overflow (CVE-2026-97555)
id: 8f3b2c1a-7d4e-4a9b-9c2e-1f0a6b5d3e21
status: experimental
description: Detects kernel/CIFS log indicators consistent with CVE-2026-97555 heap out-of-bounds write during DACL owner/group rewrite
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97555
author: valtersit.com
date: 2026-01-01
logsource:
  product: linux
  service: kernel
detection:
  selection_kasan:
    - 'KASAN: slab-out-of-bounds'
  selection_cifs:
    - 'build_sec_desc'
    - 'cifs'
  selection_acl_rewrite:
    - 'id_mode_to_cifs_acl'
    - 'replace_sids_and_copy_aces'
  condition: selection_kasan and selection_cifs and selection_acl_rewrite
fields:
  - hostname
  - message
level: high
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026.97555

YARA Rule

rule CVE_2026_97555_Linux_CIFS_DACL_Overflow
{
    meta:
        description = "Heuristic detection of CVE-2026-97555 CIFS DACL owner/group rewrite heap overflow indicators in kernel logs/crash dumps"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97555"
        severity = "high"
    strings:
        $kasan = "KASAN: slab-out-of-bounds" ascii wide
        $fn1   = "build_sec_desc" ascii wide
        $fn2   = "id_mode_to_cifs_acl" ascii wide
        $fn3   = "replace_sids_and_copy_aces" ascii wide
        $cifs  = "cifs" ascii wide nocase
    condition:
        $kasan and $fn1 and $cifs and ( $fn2 or $fn3 )
}

Suricata IDS Rule

alert tcp any 445 -> any any (msg:"CVE-2026-97555 - SMB/CIFS ACL SID rewrite activity (potential client DACL overflow)"; flow:to_client,established; content:"|FF|SMB"; depth:8; content:"|05 00|"; offset:12; depth:2; classtype:attempted-admin; reference:cve,2026-97555; sid:202697555; rev:1;)

Elastic Detection

process where host.os.type == "linux" and event.action in ("exec", "start") and process.name == "chown"

Note: the KASAN trace associates the overflow with a chown task. Correlate chown execution against kernel log events containing KASAN: slab-out-of-bounds and build_sec_desc on the same host within a short window; the EQL above is a starting point for that correlation and should be refined with log ingest from kernel/journald.

Splunk SPL Query

index=linux sourcetype=kernel OR sourcetype=syslog ("KASAN" AND "slab-out-of-bounds" AND "cifs") OR "build_sec_desc" OR "id_mode_to_cifs_acl" OR "replace_sids_and_copy_aces"
| stats count min(_time) as first_seen max(_time) as last_seen by host
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="linux,cifs,cve_2026_97555,">
  <rule id="2026975" level="12">
    <decoded_as>syslog</decoded_as>
    <match>KASAN: slab-out-of-bounds</match>
    <description>CVE-2026-97555: Linux kernel CIFS client heap out-of-bounds write during DACL rewrite (build_sec_desc/cifs)</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,memory_corruption,</group>
  </rule>
  <rule id="2026976" level="10">
    <decoded_as>syslog</decoded_as>
    <match>id_mode_to_cifs_acl|replace_sids_and_copy_aces</match>
    <description>CVE-2026-97555: CIFS DACL/SID rewrite function referenced in kernel log</description>
    <group>cifs,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Disable or restrict the cifs.idmap upcall service on hosts that do not require it, reducing the conditions under which replacement SIDs are supplied during DACL rewrites.
   • Avoid CIFS mounts that activate ACL rewriting (cifsacl and mode_from_sid mount paths) where DACL ownership/group substitution is not operationally necessary; mount with options that do not trigger the rewrite path.
   • Limit local user ability to trigger chown-style DACL rewrite operations on CIFS-mounted content (least privilege, restricted sudo/ownership-change rights).
   • Monitor kernel logs and enable KASAN (where feasible in test/staging) to detect the described slab-out-of-bounds condition.

2. Patch / upgrade steps

   • No patch or fixed-version reference is available in the provided data; per the description, the fix is an upstream kernel change that budgets sizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace) for the allocation. Track the CIFS client for the corrected id_mode_to_cifs_acl/replace_sids_and_copy_aces logic.
   • There is no vendor advisory or commit hash in the data. Until a patched kernel version is identified, treat affected systems as unpatched and apply mitigations above.

3. Long-term hardening

   • Keep the Linux kernel and CIFS client current; subscribe to kernel CIFS/SMB security advisories and distribution security trackers.
   • Harden SMB/CIFS configurations: minimize id-mapping dependencies, enforce numeric SID handling, and prefer explicit, audited ACL models.
   • Deploy kernel hardening (SLAB/SLUB redzones, KASAN in test environments) and maintain host monitoring for kernel memory corruption indicators.
   • Isolate hosts that mount untrusted CIFS shares; treat file metadata origin as untrusted input.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97555
• Linux kernel CIFS/SMB client source and change history (upstream kernel tree; exact commit not available in provided data)
• FIRST.org EPSS — CVE-2026-97555 (not yet scored; https://api.first.org/data/v1/epss?cve=CVE-2026-97555)
• MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• CISA Known Exploited Vulnerabilities catalog: not listed (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-97555 in the available data.