CVE-2026-97554 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux systems with SMB client functionality enabled should assess exposure and apply the patch or update to a fixed version.

Why it matters

A vulnerability in the Linux kernel's SMB client implementation could allow an attacker to leak kernel stack contents. Linux kernel developers, maintainers, and users should assess exposure and apply the patch or update to a fixed version.

• Potential leakage of kernel stack contents to userspace.
• Possible exploitation by attackers to gain sensitive information.

Technical summary

The `cifs_posix_to_fattr()` function in the Linux kernel's SMB client implementation does not check the return value of `posix_info_parse()`. When `posix_info_parse()` returns -1 due to a malformed POSIX directory entry, the function uses uninitialized stack memory, potentially leaking kernel stack contents to the userspace idmap daemon. This vulnerability could allow an attacker to leak kernel stack contents. Linux kernel developers, maintainers, and users should assess exposure and apply the patch or update to a fixed version. The issue arises from the `cifs_posix_to_fattr()` function ignoring the return value of `posix_info_parse()`, which can return -1 when encountering a malformed POSIX directory entry.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch provided by the Linux kernel maintainers.
• Ensure that the Linux kernel is updated to a version that includes the fix.
• Monitor systems for potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but the scope of affected systems and versions is not explicitly stated. The Linux kernel's SMB client implementation is impacted.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.