CVE-2026-97554

A flaw was found in the Linux kernel's Server Message Block (SMB) client. When handling malformed directory entries with invalid security identifiers, the client fails to verify whether data parsing succeeded before processing file attributes. A malicious or compromised server could exploit this issue to pass uninitialized kernel stack memory to user space services, resulting in information disclosure.

A moderate information disclosure flaw was found in the Linux kernel SMB client as shipped in Red Hat Enterprise Linux and other Red Hat products that include the kernel. When a CIFS/SMB client lists a directory on a mount served by a malicious or compromised SMB server, the server can return malformed POSIX directory entries containing invalid security identifiers (SIDs). In this situation, cifs_posix_to_fattr() ignores the error return value of posix_info_parse() and passes the uninitialized owner and group SID data from the kernel stack to sid_to_id(), which forwards it through request_key() to the userspace idmap daemon. This can result in limited disclosure of kernel stack contents to userspace. Red Hat Enterprise Linux 6 ELS, Red Hat Enterprise Linux 7 ELS (kernel and kernel-rt), and Red Hat Enterprise Linux 8.4 are not affected because the vulnerable code is not present in those streams. For the affected Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift Container Platform streams, the fix has been deferred because the flaw is rated moderate and exploitation requires a client to access a malicious or compromised SMB server, so the issue is not scheduled for an immediate update. The residual risk of the deferral is limited to disclosure of kernel stack memory through the userspace idmap daemon when such a server is accessed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.