CVE-2026-97555: DACL heap overflow in Linux SMB client

CVE-2026-97555 is a heap overflow vulnerability in the Linux kernel CIFS module (SMB client) discovered during DACL (Discretionary Access Control List) rewrite operations. The vulnerability affects the id_mode_to_cifs_acl function, which manages mapping between POSIX permissions and CIFS ACLs. When the kernel rewrites ACEs (Access Control Entries) with new Security Identifiers (SIDs) obtained from the cifs.idmap remapping system, it may allocate insufficient buffer space if the new SIDs are significantly larger than the originals, causing heap overflow.

The vulnerability is rated CVSS 8.8 (high). The issue arises because replace_sids_and_copy_aces can expand each ACE up to 76 bytes when using maximum-length SIDs (15 sub-authorities), while the buffer is allocated according to the original on-disk DACL size. On October 29, 2026, public repositories on GitHub released proof-of-concept and exploit chains for arm64 architectures demonstrating credential overwrite with root privileges (uid-0).

System administrators and IT teams must urgently verify if affected systems mount CIFS/SMB filesystems with cifsacl or mode_from_sid options and check kernel version. Immediate mitigation involves updating the Linux kernel to a patched version from the official fix. Absent a patch, restricting access to DACL remapping operations and monitoring kernel logs for KASAN messages or anomalies related to the cifs.ko module is essential.