Linux Kernel: cifs.ko Heap Overflow in id_mode_to_cifs_acl (CVE-2026-97555)

A heap-based buffer overflow exists in the Linux kernel cifs.ko module, specifically within the id_mode_to_cifs_acl() function. The vulnerability occurs when the client attempts to rewrite Access Control Entries (ACEs) while replacing owner/group Security Identifiers (SIDs). An attacker-controlled SMB server can provide a specially crafted DACL that causes the rewritten security descriptor to grow larger than the pre-allocated kernel heap buffer. This results in an out-of-bounds write past the slab object. An exploit has been published demonstrating a full chain from memory corruption to a uid-0 shell on Android 16 GKI-based 6.12 kernels.

Attack Chain

1. Share Setup - The attacker configures a malicious SMB2/3 server capable of providing custom DACL layouts (cross7).
2. Mounting - The victim system mounts the attacker-controlled share using cifsacl and modefromsid mount options.
3. Trigger - The attacker initiates a chown operation on a file within the share, causing the kernel to call id_mode_to_cifs_acl().
4. Overflow - The kernel calculates an allocation size that is insufficient for the rewritten DACL, resulting in a heap buffer overflow.
5. Heap Grooming - The overflow overwrites adjacent kernel objects; the published exploit uses pipe_buffer arrays to gain memory corruption primitives.
6. KASLR Leak - The overflow modifies a key payload, allowing the attacker to dump memory and calculate the KASLR slide.
7. Privilege Escalation - The attacker reclaims page-table pages to write arbitrary PTEs, ultimately modifying the current task's cred structure to escalate to uid 0.

Impact

Confirmed local privilege escalation to uid 0 (root) on reference environments (Android 16 GKI-based 6.12). The out-of-bounds write is observable by the malicious SMB server and can cause kernel panics on non-vulnerable or mismatched memory layouts.

Recommendation

• Apply the vendor-provided patch for cifs.ko (upstream 0ee150794c75, stable fb736ab4fb8c).
• Restrict the ability of non-privileged users to mount SMB shares.
• Disable the cifsacl and modefromsid mount options on production systems unless explicitly required and validated against trusted infrastructure.
• Monitor kernel dmesg logs for unexpected panics occurring during SMB share access.