Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When id_mode_to_cifs_acl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by dacl_ptr->size. However, replace_sids_and_copy_aces may rewrite each ACE with a new owner/group SID obtained from the cifs.idmap upcall. Those SIDs can have up to SID_MAX_SUB_AUTHORITIES (15) sub-authorities, making each ACE up to 76 bytes (sizeof(struct smb_ace)). If the original DACL contains short SIDs (e.g., 1 sub-authority) while the replacement SIDs are long, the rewritten ACEs overflow the allocation. Fix this by always budgeting for worst-case SID expansion: allocate sizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), which covers the smb_acl header and room for every ACE at maximum SID size. This replaces the previous split logic that used dacl_ptr->size for cifsacl mounts but num_aces * sizeof(struct smb_ace) for mode_from_sid mounts: both paths can trigger the same rewrite and need the same headroom. KASAN reports this as: BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x1e8a/0x2680 [cifs] Write of size 4 at addr ffff8881a5e25374 by task chown/5298 ... The buggy address is located 0 bytes to the right of allocated 884-byte region [ffff8881a5e25000, ffff8881a5e25374)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-25T11:17:05.963Z",
  "pubdate": "2026-09-25T11:17:05.963Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability exists in the Linux kernel's CIFS/SMB client implementation, specifically within the DACL (Discretionary Access Control List) owner/group rewrite logic.\nThe vulnerability arises from an incorrect buffer size calculation when remapping SIDs (Security Identifiers) during DACL modifications.\nAn attacker capable of triggering DACL rewrites on a CIFS mount can induce a heap overflow, potentially leading to kernel memory corruption, system instability, or arbitrary code execution.\nThe flaw affects systems using the cifs.idmap upcall mechanism where short SIDs are replaced by longer SIDs containing more sub-authorities.\nSuccessful exploitation requires the ability to influence or trigger CIFS ACL operations, which may require privileged access or specific configurations that allow untrusted users to interact with SMB object metadata.\nThis vulnerability is categorized as a memory corruption flaw, necessitating immediate kernel patching to ensure the allocation logic accounts for worst-case SID size expansion.",
  "technicalDetails": "The root cause of this vulnerability is an undersized heap allocation in id_mode_to_cifs_acl when performing DACL rewrite operations. The Linux kernel's CIFS client calculates the required memory based on the existing on-disk DACL size reported by dacl_ptr->size. However, the subsequent function replace_sids_and_copy_aces replaces existing SIDs with new values obtained via the cifs.idmap upcall.\nUnder the SMB protocol, an ACE (Access Control Entry) can contain a SID with up to SID_MAX_SUB_AUTHORITIES (15), resulting in a maximum size of 76 bytes per struct smb_ace. When the original on-disk DACL contains compact SIDs (e.g., those with only one sub-authority) and is processed for replacement, the replacement SIDs often occupy significantly more space than the original entries.\nBecause the initial buffer allocation does not account for this expansion, replacing short SIDs with longer, expanded SIDs causes the function to write beyond the bounds of the allocated slab memory, leading to a heap-based buffer overflow.\nThe attack flow involves: 1) An attacker manipulates or creates CIFS object permissions that trigger a DACL rewrite (e.g., using chown or chmod operations). 2) The kernel calls id_mode_to_cifs_acl, which allocates a buffer based on the legacy, smaller size. 3) replace_sids_and_copy_aces iterates through the ACEs, substituting SIDs. 4) As the replacement process exceeds the buffer limit, it performs an out-of-bounds write to the adjacent kernel heap memory.\nKASAN instrumentation confirms this as a slab-out-of-bounds write, where the memory corruption occurs immediately following the allocated 884-byte region. This behavior can overwrite adjacent kernel heap objects, leading to system crashes (kernel panic) or potential primitive escalation by corrupting sensitive kernel structures located in the vicinity of the overflow.\nThe vulnerability is present in the interaction between the CIFS client and the user-space cifs.idmap upcall mechanism. It does not strictly require network exposure if local users have write access to objects on a CIFS mount, as the kernel-level rewrite logic is invoked locally regardless of the underlying network state of the SMB share."
}