CVE-2026-97561 Linux CVE debrief

Who should care

Linux administrators and users who utilize forceuid/forcegid mount options should assess their exposure and apply kernel updates to ensure these options are enforced. This includes reviewing system configurations, verifying kernel versions, and monitoring file ownership changes. Security teams should prioritize patching and compensating controls for exposed systems.

Why it matters

CVE-2026-97561 allows an untrusted server to dictate local file ownership when forceuid/forcegid mount options are used in the Linux kernel. Linux administrators should assess exposure, apply kernel updates, and monitor file ownership changes.

• Verify Linux kernel versions and configurations for exposure
• Assess and apply updates to ensure forceuid/forcegid are enforced
• Monitor file ownership changes for potential unauthorized access

Technical summary

The Linux kernel vulnerability CVE-2026-97561 allows an untrusted server to override file ownership when forceuid/forcegid mount options are used. This occurs because the sid_to_id() function was called unconditionally in several code paths, ignoring the administrator's explicit uid/gid override. The vulnerability affects Linux kernel deployments that utilize SMB client and have not been patched. The fix involves adding checks for CIFS_MOUNT_OVERR_UID and CIFS_MOUNT_OVERR_GID before calling sid_to_id(). This ensures that the forceuid/forcegid mount options are enforced.

Defensive priority

Assess and apply Linux kernel updates to ensure forceuid/forcegid mount options are enforced.

Recommended defensive actions

• Assess Linux kernel versions for exposure
• Apply kernel updates enforcing forceuid/forcegid
• Verify mount configurations for forceuid/forcegid usage
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify versions or widespread exploitation. The vulnerability was introduced due to the lack of checks for CIFS_MOUNT_OVERR_UID and CIFS_MOUNT_OVERR_GID before calling sid_to_id(). Evidence of exploitation is not provided, and defenders should verify their systems' exposure and apply kernel updates accordingly. The Linux kernel patch addresses this by adding checks for these flags.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.