CVE-2024-26822

What it actually does

The vulnerability allows incorrect uid, gid, and cruid values from a parent SMB mount to be reused in child automounts when not explicitly specified, resulting in authorization bypass where filesystem operations execute under unintended user contexts.

Why it matters to the business

Organizations running affected Linux kernels may experience unauthorized file access or modification in multiuser SMB environments, increasing risk of data integrity issues and requiring urgent kernel updates to avoid operational disruptions.

How an attack unfolds

An attacker with local access triggers an SMB automount without specifying uid/gid/cruid parameters; the kernel reuses parent mount credentials instead of dynamically setting per-user values, allowing operations under mismatched user identities that bypass intended access controls.

How to fix it

Upgrade Linux kernel to fixed versions including 5.15.201 or apply commit 4a6e4c56721a3e6e2550b72ec56aab306c4607a7; rebuild and reboot systems using multiuser SMB automounts.

How to confirm the fix worked

Verify running kernel version is at or above the fixed releases; test automount behavior with unspecified uid/gid/cruid to confirm dynamic ID assignment occurs; review dmesg or mount logs for context inheritance warnings.

Typical attack path

1. Obtain local access on a Linux system using SMB client automounts
2. Trigger automount of a multiuser SMB share without explicit uid/gid/cruid
3. Kernel reuses parent mount IDs for the new mount
4. Perform file operations that succeed or fail based on incorrect authorization context

How to detect it

Review system logs for SMB mount events showing reused parent IDs; inspect mount options in /proc/mounts or kernel traces for missing uid/gid on automounted shares; correlate with local user activity that accesses unexpected files.

What your security team should do

• Prioritize kernel upgrades on all systems using SMB automounts within 30 days
• Audit multiuser SMB configurations for explicit uid/gid settings as a temporary control
• Monitor for new kernel releases in stable branches and test in staging environments
• Disable unnecessary automount features until patched if risk is high