CVE-2026-97555

A flaw was found in the Linux kernel's SMB client. When rewriting a Discretionary Access Control List (DACL) during file ownership updates, the kernel allocates memory based on the original identifier lengths rather than accounting for larger replacement Security Identifiers (SIDs). A local user can exploit this vulnerability by modifying file attributes on a mounted SMB share, triggering a heap-based buffer overflow that may lead to a Denial of Service (DoS) or potential privilege escalation.

This vulnerability is rated as Moderate impact because exploitation requires local access on a system with an active CIFS/SMB share mounted using specific ACL handling options. Under typical deployments, SMB shares are not mounted with custom security identifier rewriting enabled by default, limiting exposure. An authenticated local user must have permissions to alter file attributes on such mounts to trigger the memory corruption, restricting the blast radius to environments actively utilizing these configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.