CVE-2026-97554
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() cifs_posix_to_fattr() ignores the return value of posix_info_parse(). When a malformed POSIX directory entry is encountered (e.g. invalid SID lengths from an untrusted server), posix_info_parse() returns -1 without populating the 'parsed' struct. The uninitialized stack memory in parsed.owner and parsed.group is then passed to sid_to_id(), which processes the garbage bytes and passes them to request_key() to construct a SID string, potentially leaking kernel stack contents to the userspace idmap daemon. Fix this by checking the return value and skipping the SID-to-id mapping when parsing fails. The remaining fattr fields (timestamps, mode, etc.) are populated directly from the 'info' pointer so they are unaffected.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 9934430e2178d5164eb1ac91a9b092f9e7e64745 | affected | git | 604feb3e8141bf11f5afd48d36d401fee5af9536 | Unavailable | None listed |
| 9934430e2178d5164eb1ac91a9b092f9e7e64745 | affected | git | 33106019c3be57b5fc6411cfaad6d98214a51265 | Unavailable | None listed |
| 9934430e2178d5164eb1ac91a9b092f9e7e64745 | affected | git | 2be31f252ade791b84f7164991f14436aed1d4b9 | Unavailable | None listed |
| 9934430e2178d5164eb1ac91a9b092f9e7e64745 | affected | git | c9a8b60ce140a68d172452f418137fc7ddbae7db | Unavailable | None listed |
| 9934430e2178d5164eb1ac91a9b092f9e7e64745 | affected | git | da6e25842431982d5a53cf00d925b98c690f4467 | Unavailable | None listed |
| dd80b98bdf0a4b3206739f3513b0518f27a7b4ef | affected | git | Unavailable | Unavailable | None listed |
| d8e39c11f66125f49de55537a6efc8ecadf4a0f7 | affected | git | Unavailable | Unavailable | None listed |
| 5.8.17 | affected | semver | 5.9 | Unavailable | None listed |
| 5.9.2 | affected | semver | 5.10 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 5.10 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 5.10 | Unavailable | None listed |
| 6.6.160 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.114 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.57 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.2.7 | unaffected | semver | Unavailable | 7.2.* | None listed |
| 7.3 | unaffected | original_commit_for_fix | Unavailable | * | None listed |