CVE-2026-97559 Linux CVE debrief

Who should care

Linux kernel developers, administrators responsible for maintaining and securing Linux-based systems, particularly those using SMB clients, and security teams should be aware of this vulnerability. They should verify patch levels, monitor system logs, and review system configurations to ensure the SMB client is properly secured. Additionally, security auditors and compliance teams may need to review system configurations and verify that appropriate mitig

Why it matters

A vulnerability in the Linux kernel's SMB client implementation can cause a buffer overflow when rewriting DACLs, potentially leading to corruption of the DACL. Linux kernel developers and administrators should verify patch levels and monitor system logs to ensure system security.

• Verify Linux kernel version and patch level to ensure vulnerability is patched
• Monitor system logs for potential corruption of DACLs
• Review system configurations to ensure SMB client is properly secured

Technical summary

The Linux kernel's SMB client implementation has a vulnerability that can cause a buffer overflow when rewriting DACLs. This occurs when the new DACL exceeds 64K in size, causing the accumulator to wrap and potentially leading to corruption of the DACL. The issue has been resolved by adjusting the code to use a u32 internally and returning -EOVERFLOW in the overflow case. The vulnerability arises from the accumulation of DACL size in a u16, which can wrap and lead to incorrect offset calculations. This can result in sending corrupted DACLs to the server. The fix prevents the buffer overflow by using a larger data type for the accumulator, ensuring that the operation is refused if the new DACL exceeds the 64K. A

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to ensure the Linux kernel's SMB client implementation is updated
• Verify that the system's Linux kernel is up-to-date with the latest security patches
• Monitor system logs for potential corruption of DACLs
• Perform a thorough review of system configurations to ensure SMB client is properly secured
• Conduct regular security audits to identify potential vulnerabilities
• Implement additional monitoring and logging to detect similar issues in the future
• Review and update incident response plans to address potential exploitation of this vulnerability

Evidence notes

The vulnerability is caused by the accumulation of DACL size in a u16, which can wrap and lead to corruption of the DACL. The issue is resolved by using a u32 internally and returning -EOVERFLOW in the overflow case.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.