CVE-2026-99110 (GCVE-0-2026-99110)

Vulnerability from cvelistv5 – Published: 2026-10-28 10:34 – Updated: 2026-10-31 12:43
VLAI
Title
smb: client: fix heap overflow in cifs_do_set_acl()
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in cifs_do_set_acl() cifs_set_acl() validates ACL size using posix_acl_xattr_size(): 4 + (count * 8) // 4-byte header + 8 bytes per ACE cifs_do_set_acl() then calls posix_acl_to_cifs() to write the CIFS wire format into the same buffer: 6 + (count * 10) // 6-byte header + 10 bytes per ACE An ACL that passes the xattr-based check in cifs_set_acl() can overflow the heap when posix_acl_to_cifs() writes the larger CIFS format. Validate the CIFS format size against the remaining buffer space and USHRT_MAX before converting--data_count is __u16, so sizes above USHRT_MAX truncate the on-wire packet length, causing the server to apply a partial ACL. Replace MaxDataCount = 1000 with min(CIFSMaxBufSize, USHRT_MAX).
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6971 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: dc1af4c4b4721abfa07b351063825acc7e69cc66 , < 68652afb9b9adf70125971abee9b95341e042249 (git)
Affected: dc1af4c4b4721abfa07b351063825acc7e69cc66 , < 9312a00215602ba028495ef3fa00fb84af0478e0 (git)
Affected: dc1af4c4b4721abfa07b351063825acc7e69cc66 , < d96f3365ce61c5f39602955af43c8174548dee98 (git)
Affected: dc1af4c4b4721abfa07b351063825acc7e69cc66 , < 596b4062e6c75bdd85a7f2b7f2087a872dc420ac (git)
Affected: dc1af4c4b4721abfa07b351063825acc7e69cc66 , < 1dac61e2c29d1a71784604b48cf3b1234a65ec29 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.6.161 , ≤ 6.6.* (semver)
Unaffected: 6.12.115 , ≤ 6.12.* (semver)
Unaffected: 6.18.59 , ≤ 6.18.* (semver)
Unaffected: 7.2.13 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifssmb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "68652afb9b9adf70125971abee9b95341e042249",
              "status": "affected",
              "version": "dc1af4c4b4721abfa07b351063825acc7e69cc66",
              "versionType": "git"
            },
            {
              "lessThan": "9312a00215602ba028495ef3fa00fb84af0478e0",
              "status": "affected",
              "version": "dc1af4c4b4721abfa07b351063825acc7e69cc66",
              "versionType": "git"
            },
            {
              "lessThan": "d96f3365ce61c5f39602955af43c8174548dee98",
              "status": "affected",
              "version": "dc1af4c4b4721abfa07b351063825acc7e69cc66",
              "versionType": "git"
            },
            {
              "lessThan": "596b4062e6c75bdd85a7f2b7f2087a872dc420ac",
              "status": "affected",
              "version": "dc1af4c4b4721abfa07b351063825acc7e69cc66",
              "versionType": "git"
            },
            {
              "lessThan": "1dac61e2c29d1a71784604b48cf3b1234a65ec29",
              "status": "affected",
              "version": "dc1af4c4b4721abfa07b351063825acc7e69cc66",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifssmb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.115",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.161",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.115",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.59",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.13",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix heap overflow in cifs_do_set_acl()\n\ncifs_set_acl() validates ACL size using posix_acl_xattr_size():\n\n        4 + (count * 8)  // 4-byte header + 8 bytes per ACE\n\ncifs_do_set_acl() then calls posix_acl_to_cifs() to write the CIFS\nwire format into the same buffer:\n\n        6 + (count * 10)  // 6-byte header + 10 bytes per ACE\n\nAn ACL that passes the xattr-based check in cifs_set_acl() can\noverflow the heap when posix_acl_to_cifs() writes the larger CIFS\nformat.\n\nValidate the CIFS format size against the remaining buffer space and\nUSHRT_MAX before converting--data_count is __u16, so sizes above\nUSHRT_MAX truncate the on-wire packet length, causing the server to\napply a partial ACL.  Replace MaxDataCount = 1000 with\nmin(CIFSMaxBufSize, USHRT_MAX)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - setxattr(2) on system.posix_acl_access/default flows through do_set_acl() \u2192 set_posix_acl() \u2192 cifs_set_acl() \u2192 patched cifs_do_set_acl(); the oversized ACL originates in the local xattr, while SMB_COM_TRANSACTION2 is only an outbound request.\nAC:H - The copy is deterministic once reached, but it requires default-off CONFIG_CIFS_POSIX, an SMB1 mount, and server negotiation of CIFS_UNIX_POSIX_ACL_CAP to set SB_POSIXACL. An unprivileged local attacker cannot create that mount or capability state.\nPR:L - set_posix_acl() gates the path with inode_owner_or_capable(), so an ordinary user who owns a file on the mounted share can submit the ACL without capabilities; on a non-multiuser mount cifs_sb_tlink() simply reuses the master tcon.\nUI:N - The attacker directly invokes setxattr() or fsetxattr() on their CIFS inode, causing cifs_set_acl() to run without any separate victim action after the qualifying mount exists.\nS:U - posix_acl_to_cifs() overwrites the client kernel\u0027s cifs_request slab, and any resulting kernel compromise remains within the same host security authority rather than crossing a VM, IOMMU, or sandbox boundary.\nC:H - cifs_init_ace() emits attacker-shaped 10-byte tag, permission, and uid/gid records past the cifs_request object; with the supported 8KiB CIFSMaxBufSize, the overflow reaches neighboring request objects. This controllable slab corruption can be groomed into reuse or overlap and kernel-memory disclosure.\nI:H - posix_acl_to_cifs() writes a multi-kilobyte out-of-bounds stream whose ACE tags, permissions, and 32-bit uid/gid values are caller-selected; corrupting adjacent request or allocator state provides heap-write and control-flow-hijack potential.\nA:H - With default CIFSMaxBufSize=16384, 2047 valid entries pass cifs_set_acl()\u0027s 16380-byte check but make posix_acl_to_cifs() write 20476 bytes, nearly 4KiB beyond the 16588-byte allocation before SendReceive() rejects the frame. Repeated calls can oops or panic the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T12:43:03.377Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/68652afb9b9adf70125971abee9b95341e042249"
        },
        {
          "url": "https://git.kernel.org/stable/c/9312a00215602ba028495ef3fa00fb84af0478e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/d96f3365ce61c5f39602955af43c8174548dee98"
        },
        {
          "url": "https://git.kernel.org/stable/c/596b4062e6c75bdd85a7f2b7f2087a872dc420ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/1dac61e2c29d1a71784604b48cf3b1234a65ec29"
        }
      ],
      "title": "smb: client: fix heap overflow in cifs_do_set_acl()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99110",
    "datePublished": "2026-10-28T10:34:28.239Z",
    "dateReserved": "2026-09-25T10:25:14.392Z",
    "dateUpdated": "2026-10-31T12:43:03.377Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-99110",
      "date": "2026-11-01",
      "epss": "0.00134",
      "percentile": "0.02919"
    },
    "microsoft_vex": {
      "current_release_date": "2026-11-01T14:47:19.000Z",
      "cve": "CVE-2026-99110",
      "id": "msrc_CVE-2026-99110",
      "initial_release_date": "2026-10-29T01:03:37.000Z",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "smb: client: fix heap overflow in cifs_do_set_acl()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-99110.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/cifssmb.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "68652afb9b9adf70125971abee9b95341e042249",
                    "status": "affected",
                    "version": "dc1af4c4b4721abfa07b351063825acc7e69cc66",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9312a00215602ba028495ef3fa00fb84af0478e0",
                    "status": "affected",
                    "version": "dc1af4c4b4721abfa07b351063825acc7e69cc66",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d96f3365ce61c5f39602955af43c8174548dee98",
                    "status": "affected",
                    "version": "dc1af4c4b4721abfa07b351063825acc7e69cc66",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "596b4062e6c75bdd85a7f2b7f2087a872dc420ac",
                    "status": "affected",
                    "version": "dc1af4c4b4721abfa07b351063825acc7e69cc66",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1dac61e2c29d1a71784604b48cf3b1234a65ec29",
                    "status": "affected",
                    "version": "dc1af4c4b4721abfa07b351063825acc7e69cc66",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/cifssmb.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.2"
                  },
                  {
                    "lessThan": "6.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.161",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.115",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.59",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix heap overflow in cifs_do_set_acl()\n\ncifs_set_acl() validates ACL size using posix_acl_xattr_size():\n\n        4 + (count * 8)  // 4-byte header + 8 bytes per ACE\n\ncifs_do_set_acl() then calls posix_acl_to_cifs() to write the CIFS\nwire format into the same buffer:\n\n        6 + (count * 10)  // 6-byte header + 10 bytes per ACE\n\nAn ACL that passes the xattr-based check in cifs_set_acl() can\noverflow the heap when posix_acl_to_cifs() writes the larger CIFS\nformat.\n\nValidate the CIFS format size against the remaining buffer space and\nUSHRT_MAX before converting--data_count is __u16, so sizes above\nUSHRT_MAX truncate the on-wire packet length, causing the server to\napply a partial ACL.  Replace MaxDataCount = 1000 with\nmin(CIFSMaxBufSize, USHRT_MAX)."
          }
        ],
        "id": "CVE-2026-99110",
        "lastModified": "2026-10-31T13:17:55.833",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-28T11:17:30.410",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1dac61e2c29d1a71784604b48cf3b1234a65ec29"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/596b4062e6c75bdd85a7f2b7f2087a872dc420ac"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/68652afb9b9adf70125971abee9b95341e042249"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9312a00215602ba028495ef3fa00fb84af0478e0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d96f3365ce61c5f39602955af43c8174548dee98"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-10-31T15:07:08+00:00",
      "cve": "CVE-2026-99110",
      "id": "CVE-2026-99110",
      "initial_release_date": "2026-10-28T00:00:00+00:00",
      "product_status:known_affected": "186",
      "product_status:known_not_affected": "93",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb: client: fix heap overflow in cifs_do_set_acl()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-99110.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.