CVE-2026-97555 Linux CVE debrief

Who should care

Linux kernel developers, Linux distribution maintainers, and users of Linux systems with SMB client functionality enabled should assess their exposure to this vulnerability and apply the available fixes.

Why it matters

A heap overflow vulnerability was found in the Linux kernel's SMB client implementation. The vulnerability occurs when rewriting an existing DACL, and it can be triggered by a local attacker with the ability to chown a file. Defenders should assess exposure, prioritize remediation, and monitor for potential exploitation attempts.

• Local attackers may be able to exploit this vulnerability to escalate privileges or cause a denial of service.
• Successful exploitation could lead to a system crash or potential code execution.
• The vulnerability can be triggered by a local attacker with the ability to chown a file.
• Exploitation requires local access to the system.

Technical summary

The vulnerability occurs in the Linux kernel's SMB client implementation, specifically in the DACL owner/group rewrite functionality. When rewriting an existing DACL, the code allocates a buffer based on the on-disk DACL length, but it does not account for the maximum possible size of the replacement SIDs. This can lead to a heap overflow when the replacement SIDs are longer than the original SIDs.

Defensive priority

High

Recommended defensive actions

• Review and apply available kernel updates to ensure the SMB client is protected against this vulnerability.
• Monitor system logs for potential exploitation attempts.
• Restrict access to sensitive files and directories to prevent exploitation.
• Perform a thorough review of system configurations and user permissions to minimize the attack surface.
• Implement additional monitoring and detection mechanisms to identify potential exploitation attempts.
• Verify the integrity of system files and directories to prevent tampering.
• Keep track of changes to system configurations and user permissions to quickly identify potential security issues.

Evidence notes

The vulnerability was reported by an unknown source and was resolved by the Linux kernel developers. The fix is available in stable kernel releases. Limited evidence is available, and defenders should verify the applicability of the fix to their specific environments. The CVE record was published on 2026-09-25T11:17:05.963Z and has not been modified since then. The vulnerability has a CVSS score of 8.8 and is considered HIGH severity. The exploit requires local access to the system.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.