Cloudanix VulnDB

CVE-2026-99110

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how Linux handles file permission lists when talking to Windows-style file shares can let an attacker crash the computer or potentially take control.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Heap overflow in Linux kernel SMB client when cifs_set_acl() under-allocates based on POSIX xattr size (4+8*count) but posix_acl_to_cifs() writes larger CIFS format (6+10*count), plus missing USHRT_MAX check allowing truncation of data_count.

Why it matters to the business

Linux systems mounting SMB shares risk crashes, memory corruption, or potential remote code execution during ACL operations; low immediate risk as vulnerability is newly published with no known exploitation.

How an attack unfolds

An attacker with write access to an SMB share supplies an ACL sized to pass the smaller POSIX check; when the client converts and writes the CIFS wire format into the undersized heap buffer, overflow occurs, potentially allowing control of execution flow or kernel panic.

How to fix it

Update the Linux kernel to a version containing the fix that validates CIFS format size against remaining buffer and replaces MaxDataCount with min(CIFSMaxBufSize, USHRT_MAX) before conversion.

How to confirm the fix worked

Confirm presence of the size-validation logic in cifs_do_set_acl() and that data_count is bounded by USHRT_MAX; test ACL set operations with ACLs near the size boundary.

Typical attack path

  1. Mount a remote SMB/CIFS share from a vulnerable Linux client
  2. Craft an ACL whose xattr size passes validation but exceeds CIFS format allocation
  3. Invoke setfacl or equivalent syscall that reaches cifs_set_acl() and posix_acl_to_cifs()
  4. Trigger heap write beyond allocated buffer

How to detect it

Review kernel logs for cifs module crashes or slab allocation failures during ACL operations; correlate with SMB file permission changes from untrusted sources.

What your security team should do

  • Prioritize kernel updates for all Linux SMB clients within standard patch windows
  • Restrict untrusted ACL modifications on SMB mounts until patched
  • Monitor upstream stable kernel releases for the backported fix

The record

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in cifs_do_set_acl() cifs_set_acl() validates ACL size using posix_acl_xattr_size(): 4 + (count * 8) // 4-byte header + 8 bytes per ACE cifs_do_set_acl() then calls posix_acl_to_cifs() to write the CIFS wire format into the same buffer: 6 + (count * 10) // 6-byte header + 10 bytes per ACE An ACL that passes the xattr-based check in cifs_set_acl() can overflow the heap when posix_acl_to_cifs() writes the larger CIFS format. Validate the CIFS format size against the remaining buffer space and USHRT_MAX before converting--data_count is __u16, so sizes above USHRT_MAX truncate the on-wire packet length, causing the server to apply a partial ACL. Replace MaxDataCount = 1000 with min(CIFSMaxBufSize, USHRT_MAX).

Affected packages

Ecosystem Package Introduced Fixed