CVE-2026-99110

A flaw was found in the Linux kernel's Common Internet File System (CIFS) client. When converting a POSIX Access Control List (ACL) to the network wire format, the kernel verifies the ACL against an extended attribute size calculation instead of the larger network format size, leading to a heap-based buffer overflow. A local user can exploit this vulnerability by setting an access control list on a mounted share to achieve privilege escalation, execute arbitrary code, or crash the system, causing a Denial of Service (DoS).

This vulnerability is rated as Important severity because an unprivileged local user could leverage heap corruption in kernel space to achieve root privileges or trigger an operating system denial of service. Exploitation requires that a CIFS/SMB network share is mounted and that the local attacker possesses permissions to set file attributes on the remote filesystem. Standard Red Hat Enterprise Linux configurations are not exposed unless an SMB share is actively mounted with POSIX ACL handling enabled.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.