Read the docs
TI-2026-81817 Aliases CVE-2026-99110GHSA-82wh-j3w4-q4wc

Heap overflow in Linux kernel SMB client ACL handling

Priority LOW 30Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

The Linux kernel SMB client in cifs_do_set_acl() writes a CIFS-format ACL into a heap buffer sized only for the smaller xattr format, which causes a heap overflow. A local user with low privileges can trigger it with a crafted ACL, under high attack complexity, with high impact on confidentiality, integrity and availability. The flaw is in the Linux kernel from 6.2 onward, before the fixed commits listed for each branch.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Description from the CNA

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in cifs_do_set_acl() cifs_set_acl() validates ACL size using posix_acl_xattr_size(): 4 + (count * 8) // 4-byte header + 8 bytes per ACE cifs_do_set_acl() then calls posix_acl_to_cifs() to write the CIFS wire format into the same buffer: 6 + (count * 10) // 6-byte header + 10 bytes per ACE An ACL that passes the xattr-based check in cifs_set_acl() can overflow the heap when posix_acl_to_cifs() writes the larger CIFS format. Validate the CIFS format size against the remaining buffer space and USHRT_MAX before converting--data_count is __u16, so sizes above USHRT_MAX truncate the on-wire packet length, causing the server to apply a partial ACL. Replace MaxDataCount = 1000 with min(CIFSMaxBufSize, USHRT_MAX).

Why it matters now

EPSS 0.00134 2nd percentileScored 2026-11-07
Fix Partial Linux (Linux): 6.6.161, 6.12.115, 6.18.59 +2Red Hat: 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux6.2 and later6.6.161, 6.12.115, 6.18.59, 7.2.13, 7.3Patch availableCNA
  • Linux VendorLinux Affected 6.2 and later Fixed in 6.6.161, 6.12.115, 6.18.59, 7.2.13, 7.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*——Linux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions — — ·Linux

Remediation

Upgrade the Linux kernel to 6.6.161, 6.12.115, 6.18.59, 7.2.13 or 7.3, depending on the branch in use. Red Hat lists Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 and Red Hat OpenShift Container Platform 5 as affected with plan none_available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

  • Fix · CNA Linux (Linux) Fixed in 6.6.161, 6.12.115, 6.18.59, 7.2.13, 7.3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Not affected: 5 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-99110
  2. 2026-10-28 Alias added: GHSA-82wh-j3w4-q4wc
  3. 2026-10-29 Affected versions changed · Red Hat
  4. 2026-10-29 CVSS score added · Red Hat
  5. 2026-10-30 Fix available: Linux/[email protected], Linux/[email protected], Linux/Linux@68652afb9b9adf70125971abee9b95341e042249 +1 · CNA
  6. 2026-10-30 2 new references · CNA
  7. 2026-10-30 Affected versions changed · Red Hat
  8. 2026-10-31 CVSS score added · CNA

References

Other 5

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
See all 21727 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences