Executive brief
The Linux kernel's CIFS (Common Internet File System) client fails to properly clear the setuid and setgid permission bits when writing to files mounted with certain security options (cifsacl, modefromsid, or POSIX extensions). This allows privilege escalation on subsequent execution, as the elevated permission bits persist on the server despite being stripped on local filesystems. The vulnerability affects networked file systems accessed through SMB protocols.
Technical details
The vulnerability exists in the CIFS kernel client's file attribute handling, specifically in cifs_setattr_unix() and cifs_setattr_nounix() functions. When the VFS detects a write to a file with setuid or setgid bits set, it issues a setattr request with ATTR_KILL_SUID/ATTR_KILL_SGID flags and a cleared ATTR_MODE. However, these functions unconditionally drop ATTR_MODE, preventing the cleared mode from reaching the server when using cifsacl, modefromsid, or SMB3.1.1 POSIX extensions. This means the setuid/setgid bits survive on the server while being stripped locally, creating an inconsistency. The fix involves preserving ATTR_MODE in these cases so the cleared bits are properly propagated to the server. No user interaction is required; the vulnerability is triggered on any write to an affected file.
Affected products
- Linux Linux kernel <unknown>
Timeline
- 2026-09-11: disclosed