CVE-2026-97561

A flaw was found in the Linux kernel's Server Message Block (SMB) client. When an administrator mounts a remote share with options configured to force specific local user and group ownership, the client fails to enforce these restrictions and instead accepts ownership values provided by the remote server. A malicious or untrusted SMB server can exploit this flaw during file or directory lookups to dictate local file ownership, potentially bypassing local access controls and leading to unauthorized access.

An SMB client mount configured with forceuid or forcegid could still accept server supplied SID ownership mappings in several metadata handling paths. A malicious or compromised SMB server can cause files to appear owned by unexpected local users or groups, bypassing the administrators intended ownership policy. This is network reachable after a client mounts an attacker controlled or compromised SMB share with forceuid or forcegid enabled. For the CVSS the PR:N because the remote server does not need privileges on the victim after the vulnerable mount is established. Impact depends on local id mapping and permission checks. It may allow limited confidentiality and integrity impact through incorrect local ownership decisions. This is a policy bypass and no memory corruption or kernel crash is indicated.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.