CVE-2026-97561
Description
A flaw was found in the Linux kernel's Server Message Block (SMB) client. When an administrator mounts a remote share with options configured to force specific local user and group ownership, the client fails to enforce these restrictions and instead accepts ownership values provided by the remote server. A malicious or untrusted SMB server can exploit this flaw during file or directory lookups to dictate local file ownership, potentially bypassing local access controls and leading to unauthorized access.
Statement
An SMB client mount configured with forceuid or forcegid could still accept server supplied SID ownership mappings in several metadata handling paths. A malicious or compromised SMB server can cause files to appear owned by unexpected local users or groups, bypassing the administrators intended ownership policy. This is network reachable after a client mounts an attacker controlled or compromised SMB share with forceuid or forcegid enabled. For the CVSS the PR:N because the remote server does not need privileges on the victim after the vulnerable mount is established. Impact depends on local id mapping and permission checks. It may allow limited confidentiality and integrity impact through incorrect local ownership decisions. This is a policy bypass and no memory corruption or kernel crash is indicated.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.4 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | Required | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context; Gain Privileges or Assume Identity
When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
