Executive brief
A vulnerability in the Linux kernel's SMB client could allow a malicious or compromised server to provide incorrect file permission data. This occurs when the client incorrectly processes security identifiers (SIDs) used to represent file modes, potentially leading to unexpected file access behaviors on the client system. Users should update their Linux kernel to the latest stable version to ensure file permissions are correctly validated.
Technical details
A vulnerability exists in the Linux kernel SMB client (cifs.ko) within the 'modefromsid' functionality. The 'parse_dacl()' function in 'fs/smb/client/cifsacl.c' (or 'fs/cifs/cifsacl.c' in older versions) applies a server-provided 'sub_auth[2]' value from an NFS mode SID to 'cf_mode' without applying the required 07777 mask. This allows a remote SMB server to potentially inject unexpected mode bits into the client's file attributes. The issue is resolved by ensuring the server-provided value is masked to 07777, consistent with other permission-reading paths in the kernel. Patches have been backported to multiple stable kernel branches including 5.10.y, 5.15.y, 6.1.y, and 6.6.y.
Affected products
- Linux Linux Kernel 5.4 to 5.10.261, 5.15.212, 6.1.178, 6.6.145
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory
- 2026-07-24: patched
References
- https://git.kernel.org/stable/c/08c600b7e1818539ba5efee4cdb06215c245ca78
- https://git.kernel.org/stable/c/5f6f2241034f189c69d4d0b5f8fe24a0c25b0c14
- https://git.kernel.org/stable/c/b84e002e0df26bbc6cbd3ca01b8212601fe0ae7d
- https://git.kernel.org/stable/c/c6c484a7d5bff6b929a86d7ed5130f29834c6a0d
- https://git.kernel.org/stable/c/e3d9c7160d483fc8f9e225aafad8ecbbc43f3151
- https://git.kernel.org/stable/c/ee2216dbdf0c677e89bb43e03247dba590ed00ef
- https://git.kernel.org/stable/c/f511807feee7cb29b61bdfa86472c7e9e2e5df94