CVE-2026-97559

A flaw was found in the Linux kernel's SMB client. An integer overflow during Discretionary Access Control List (DACL) reconstruction can allow a local user to corrupt file access permissions sent to a remote server. When processing file permission or ownership updates with numerous access control entries, the DACL size accumulator can wrap around if the expanded list exceeds 64 kilobytes. This flaw results in malformed access control data being transmitted to the server, potentially leading to unauthorized permission changes.

A flaw was found in the Linux kernel SMB client, where the DACL rewriting functions replace_sids_and_copy_aces() and set_chmod_dacl() accumulate the size of the access control list they build in a 16-bit integer. A local user who is allowed to change file permissions or ownership on a mounted SMB share can trigger an integer wraparound when the rewritten DACL exceeds 64 KB, which is reachable with roughly 863 or more access control entries after SID replacement. After the wraparound the DACL size becomes meaningless, so a corrupted DACL is transmitted to the SMB server, potentially resulting in unauthorized permission changes on the affected file. The corruption stays within the allocated buffer, so this is not an out-of-bounds memory write. Red Hat rated this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access with privileges on the mount and an exceptionally large DACL. Affected Red Hat products include Red Hat Enterprise Linux 8.10, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS 2, and OpenShift versions based on RHEL CoreOS 9; RHEL 6, RHEL 7, the RHEL 8.4, 8.6, and 8.8 z-streams, and OpenShift versions based on RHEL CoreOS 8 are not affected because the vulnerable code is not present in those streams. Fixes for the affected streams are currently deferred; the residual risk is limited because triggering the flaw requires an unusual configuration with a very large DACL and the impact is confined to the integrity of file access permissions sent to the server.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.