All vulnerabilities
CVE-2026-99110

Linux: smb: client: fix heap overflow in cifs_do_set_acl()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in596b4062e6c75bdd85a7f2b7f2087a872dc420acAlso 1dac61e2c29d1a71784604b48cf3b1234a65ec29CVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 596b4062e6c75bdd85a7f2b7f2087a872dc420acLinuxCVE List
  • 1dac61e2c29d1a71784604b48cf3b1234a65ec29LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix heap overflow in cifs_do_set_acl()

cifs_set_acl() validates ACL size using posix_acl_xattr_size():

4 + (count * 8) // 4-byte header + 8 bytes per ACE

cifs_do_set_acl() then calls posix_acl_to_cifs() to write the CIFS wire format into the same buffer:

6 + (count * 10) // 6-byte header + 10 bytes per ACE

An ACL that passes the xattr-based check in cifs_set_acl() can overflow the heap when posix_acl_to_cifs() writes the larger CIFS format.

Validate the CIFS format size against the remaining buffer space and USHRT_MAX before converting--data_count is __u16, so sizes above USHRT_MAX truncate the on-wire packet length, causing the server to apply a partial ACL. Replace MaxDataCount = 1000 with min(CIFSMaxBufSize, USHRT_MAX).

Text from CVE List

Affected versions 8

  • Linuxaffected: dc1af4c4b4721abfa07b351063825acc7e69cc66 before d96f3365ce61c5f39602955af43c8174548dee98CVE List
  • Linuxaffected: dc1af4c4b4721abfa07b351063825acc7e69cc66 before 596b4062e6c75bdd85a7f2b7f2087a872dc420acCVE List
  • Linuxaffected: dc1af4c4b4721abfa07b351063825acc7e69cc66 before 1dac61e2c29d1a71784604b48cf3b1234a65ec29CVE List
  • Linuxaffected: 6.2CVE List
  • Linuxunaffected: all versions before 6.2CVE List
  • Linuxunaffected: 6.18.59 through 6.18.*CVE List
  • Linuxunaffected: 7.2.13 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3