CVE-2026-89638

A flaw was found in the Linux kernel's Server Message Block (SMB) client. When a file with the setuid or setgid bit is written to on certain Common Internet File System (CIFS) mounts (specifically those using 'cifsacl', 'modefromsid' options, or SMB3.1.1 POSIX extensions), the kernel fails to properly clear these bits on the server. This oversight allows the setuid/setgid bits to persist, which could enable a local attacker to achieve unexpected privilege escalation upon subsequent execution of the affected file.

This vulnerability is rated as an Important severity flaw because an authenticated local user with write permissions to an executable on an affected network share could modify the file while retaining elevated privileges, resulting in local privilege escalation to root or another user. Standard CIFS mounts in Red Hat Enterprise Linux emulate file modes using DOS attributes and are unaffected by default. Risk is confined to environments utilizing advanced permission mapping options, such as cifsacl, modefromsid, or POSIX extensions, where users possess write access to binaries executed with elevated capabilities.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mount SMB/CIFS shares with the nosuid mount option to prevent setuid and setgid binaries from executing with elevated permissions, or prevent the cifs module from loading if network SMB shares are not needed.

1. Apply nosuid to an active mount point:

mount -o remount,nosuid /path/to/cifs/mount

2. Persist this setting by ensuring nosuid is present in the mount options within /etc/fstab:

//server/share /mnt/cifs cifs credentials=/etc/samba/creds,nosuid 0 0

3. Alternatively, if CIFS mounts are not required on the system, disable autoloading of the kernel module:

echo "install cifs /bin/true" > /etc/modprobe.d/cifs.conf

Caveats: Enforcing nosuid prevents any executable located on the mount point from running with elevated setuid or setgid privileges. Blacklisting the cifs module prevents all SMB/CIFS network file systems from mounting. Remounting filesystems can disrupt ongoing read and write operations.