{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-97555 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-97555 is a high-severity memory corruption vulnerability in Linux, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-97555 and fix it if it is affected.\n\nWhat it is: CVE-2026-97555 is a high-severity memory corruption vulnerability in Linux, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2026-97555 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-97555/ (Markdown: https://insights.sbomify.com/CVE-2026-97555/index.md)","id":"CVE-2026-97555","markdown":"https://insights.sbomify.com/CVE-2026-97555/index.md","name":"CVE-2026-97555","record":{"aliases":["AZL-104523","BELL-CVE-2026-97555","DEBIAN-CVE-2026-97555","GHSA-3qpp-vv65-cq9g","UBUNTU-CVE-2026-97555"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel SMB client","requires_auth":"none","summary":"A heap overflow in the Linux kernel SMB client allows local attackers to execute arbitrary code or escalate privileges via crafted DACL rewrites.","user_interaction":"required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":8.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix heap overflow in DACL owner/group rewrite\n\nWhen id_mode_to_cifs_acl rewrites an existing DACL, it allocates a\nbuffer sized according to the on-disk DACL length reported by\ndacl_ptr-\u003esize. However, replace_sids_and_copy_aces may rewrite each\nACE with a new owner/group SID obtained from the cifs.idmap upcall.\nThose SIDs can have up to SID_MAX_SUB_AUTHORITIES (15) sub-authorities,\nmaking each ACE up to 76 bytes (sizeof(struct smb_ace)).\n\nIf the original DACL contains short SIDs (e.g., 1 sub-authority) while\nthe replacement SIDs are long, the rewritten ACEs overflow the\nallocation.\n\nFix this by always budgeting for worst-case SID expansion: allocate\nsizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), which\ncovers the smb_acl header and room for every ACE at maximum SID size.\nThis replaces the previous split logic that used dacl_ptr-\u003esize for\ncifsacl mounts but num_aces * sizeof(struct smb_ace) for mode_from_sid\nmounts: both paths can trigger the same rewrite and need the same\nheadroom.\n\nKASAN reports this as:\n  BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x1e8a/0x2680 [cifs]\n  Write of size 4 at addr ffff8881a5e25374 by task chown/5298\n  ...\n  The buggy address is located 0 bytes to the right of\n   allocated 884-byte region [ffff8881a5e25000, ffff8881a5e25374)","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":"2026-10-29","github_poc":1,"max_poc_stars":2,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-10-29T13:09:14Z","kind":"github_poc","ref":"https://github.com/woshigenm/CVE-2026-97555","stars":2,"title":"CVE-2026-97555: heap overflow in the Linux SMB client DACL rewrite (cifs.ko) — analysis, POC, and an arm64 exploit chain ending in a uid-0 credential overwrite on the reference build"}],"tier":"poc_unverified"},"has_fix":true,"headline":"smb: client: fix heap overflow in DACL owner/group rewrite","id":"CVE-2026-97555","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"smb: client: avoid leaking refcount when cifs_sb_tlink() fails","id":"CVE-2026-97556"},"packages":[],"prev":{"headline":"smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()","id":"CVE-2026-97554"},"products":["Linux"],"published":"2026-09-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A heap overflow in the Linux kernel SMB client allows local attackers to execute arbitrary code or escalate privileges via crafted DACL rewrites.","url":"https://insights.sbomify.com/CVE-2026-97555/"}