CVE-2026-97559
Description
A flaw was found in the Linux kernel's SMB client. An integer overflow during Discretionary Access Control List (DACL) reconstruction can allow a local user to corrupt file access permissions sent to a remote server. When processing file permission or ownership updates with numerous access control entries, the DACL size accumulator can wrap around if the expanded list exceeds 64 kilobytes. This flaw results in malformed access control data being transmitted to the server, potentially leading to unauthorized permission changes.
Statement
A flaw was found in the Linux kernel SMB client, where the DACL rewriting functions replace_sids_and_copy_aces() and set_chmod_dacl() accumulate the size of the access control list they build in a 16-bit integer. A local user who is allowed to change file permissions or ownership on a mounted SMB share can trigger an integer wraparound when the rewritten DACL exceeds 64 KB, which is reachable with roughly 863 or more access control entries after SID replacement. After the wraparound the DACL size becomes meaningless, so a corrupted DACL is transmitted to the SMB server, potentially resulting in unauthorized permission changes on the affected file. The corruption stays within the allocated buffer, so this is not an out-of-bounds memory write. Red Hat rated this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access with privileges on the mount and an exceptionally large DACL. Affected Red Hat products include Red Hat Enterprise Linux 8.10, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS 2, and OpenShift versions based on RHEL CoreOS 9; RHEL 6, RHEL 7, the RHEL 8.4, 8.6, and 8.8 z-streams, and OpenShift versions based on RHEL CoreOS 8 are not affected because the vulnerable code is not present in those streams. Fixes for the affected streams are currently deferred; the residual risk is limited because triggering the flaw requires an unusual configuration with a very large DACL and the impact is confined to the integrity of file access permissions sent to the server.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (Memory); DoS: Instability
This weakness can generally lead to undefined behavior and therefore crashes. When the calculated result is used for resource allocation, this weakness can cause too many (or too few) resources to be allocated, possibly enabling crashes if the product requests more resources than can be provided. If the calculated result involves time values, then the product might crash when it encounters a time that is less than the previously-calculated time.
Integrity
Technical Impact: Modify Memory
If the value in question is important to data (as opposed to flow), simple data corruption has occurred. Also, if the overflow/wraparound results in other conditions such as buffer overflows, further memory corruption may occur.
Confidentiality,Availability,Access Control
Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism
This weakness can sometimes trigger buffer overflows, which can be used to execute arbitrary code. This is usually outside the scope of the product's implicit security policy.
Availability,Other
Technical Impact: Alter Execution Logic; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU)
If the overflow/wraparound occurs in a loop index variable, this could cause the loop to terminate at the wrong time - too early, too late, or not at all (i.e., infinite loops). With too many iterations, some loops could consume too many resources such as memory, file handles, etc., possibly leading to a crash or other DoS.
Access Control
Technical Impact: Bypass Protection Mechanism
If integer values are used in security-critical decisions, such as calculating quotas or allocation limits, integer overflows can be used to cause an incorrect security decision.
Access Control
Technical Impact: Bypass Protection Mechanism; DoS: Crash, Exit, or Restart
If integer values are used in time-based, security-critical decisions, such as calculating expiration times or determining whether an event occurs within a specific time or date range, to cause an incorrect security decision. The consequences could even include "self-DoS" if the overflow produces a time value that is not accounted for in protection mechanism logic [REF-1570].
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
