# CVE-2026-97555: smb: client: fix heap overflow in DACL owner/group rewrite

> A heap overflow in the Linux kernel SMB client allows local attackers to execute arbitrary code or escalate privileges via crafted DACL rewrites.

- **Severity:** High 8.8 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 25 Sep 2026
- **Updated:** 19 Oct 2026
- **Also known as:** AZL-104523, BELL-CVE-2026-97555, DEBIAN-CVE-2026-97555, GHSA-3qpp-vv65-cq9g, UBUNTU-CVE-2026-97555

## What is CVE-2026-97555?

CVE-2026-97555 is a high-severity memory corruption vulnerability in Linux, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix heap overflow in DACL owner/group rewrite

When id_mode_to_cifs_acl rewrites an existing DACL, it allocates a
buffer sized according to the on-disk DACL length reported by
dacl_ptr->size. However, replace_sids_and_copy_aces may rewrite each
ACE with a new owner/group SID obtained from the cifs.idmap upcall.
Those SIDs can have up to SID_MAX_SUB_AUTHORITIES (15) sub-authorities,
making each ACE up to 76 bytes (sizeof(struct smb_ace)).

If the original DACL contains short SIDs (e.g., 1 sub-authority) while
the replacement SIDs are long, the rewritten ACEs overflow the
allocation.

Fix this by always budgeting for worst-case SID expansion: allocate
sizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), which
covers the smb_acl header and room for every ACE at maximum SID size.
This replaces the previous split logic that used dacl_ptr->size for
cifsacl mounts but num_aces * sizeof(struct smb_ace) for mode_from_sid
mounts: both paths can trigger the same rewrite and need the same
headroom.

KASAN reports this as:
  BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x1e8a/0x2680 [cifs]
  Write of size 4 at addr ffff8881a5e25374 by task chown/5298
  ...
  The buggy address is located 0 bytes to the right of
   allocated 884-byte region [ffff8881a5e25000, ffff8881a5e25374)

## Which versions are affected by CVE-2026-97555?


## How do I fix CVE-2026-97555?

Apply the vendor's patch.

## Is CVE-2026-97555 being exploited?

There is no known exploitation of CVE-2026-97555 in the wild and no public exploit code.

Public exploit code:

- CVE-2026-97555: heap overflow in the Linux SMB client DACL rewrite (cifs.ko) — analysis, POC, and an arm64 exploit chain ending in a uid-0 credential overwrite on the reference build (github_poc): https://github.com/woshigenm/CVE-2026-97555

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-97555 and fix it if it is affected.

What it is: CVE-2026-97555 is a high-severity memory corruption vulnerability in Linux, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of CVE-2026-97555 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-97555/ (Markdown: https://insights.sbomify.com/CVE-2026-97555/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-97555
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97555
- OSV: https://osv.dev/vulnerability/CVE-2026-97555

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-97555/
Summaries are generated and may contain mistakes; the official description above is the record.