{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/cifs.ko-linux-kernel--patch-0ee150794c75/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-97555"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["cifs.ko (Linux kernel \u003c patch 0ee150794c75)"],"_cs_severities":["high"],"_cs_tags":["linux","kernel","privilege-escalation","cve-2026-97555"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA heap-based buffer overflow exists in the Linux kernel \u003ccode\u003ecifs.ko\u003c/code\u003e module, specifically within the \u003ccode\u003eid_mode_to_cifs_acl()\u003c/code\u003e function. The vulnerability occurs when the client attempts to rewrite Access Control Entries (ACEs) while replacing owner/group Security Identifiers (SIDs). An attacker-controlled SMB server can provide a specially crafted DACL that causes the rewritten security descriptor to grow larger than the pre-allocated kernel heap buffer. This results in an out-of-bounds write past the slab object. An exploit has been published demonstrating a full chain from memory corruption to a uid-0 shell on Android 16 GKI-based 6.12 kernels.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eShare Setup\u003c/strong\u003e - The attacker configures a malicious SMB2/3 server capable of providing custom DACL layouts (\u003ccode\u003ecross7\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMounting\u003c/strong\u003e - The victim system mounts the attacker-controlled share using \u003ccode\u003ecifsacl\u003c/code\u003e and \u003ccode\u003emodefromsid\u003c/code\u003e mount options.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eTrigger\u003c/strong\u003e - The attacker initiates a \u003ccode\u003echown\u003c/code\u003e operation on a file within the share, causing the kernel to call \u003ccode\u003eid_mode_to_cifs_acl()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eOverflow\u003c/strong\u003e - The kernel calculates an allocation size that is insufficient for the rewritten DACL, resulting in a heap buffer overflow.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eHeap Grooming\u003c/strong\u003e - The overflow overwrites adjacent kernel objects; the published exploit uses \u003ccode\u003epipe_buffer\u003c/code\u003e arrays to gain memory corruption primitives.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eKASLR Leak\u003c/strong\u003e - The overflow modifies a key payload, allowing the attacker to dump memory and calculate the KASLR slide.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePrivilege Escalation\u003c/strong\u003e - The attacker reclaims page-table pages to write arbitrary PTEs, ultimately modifying the current task's \u003ccode\u003ecred\u003c/code\u003e structure to escalate to uid 0.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eConfirmed local privilege escalation to uid 0 (root) on reference environments (Android 16 GKI-based 6.12). The out-of-bounds write is observable by the malicious SMB server and can cause kernel panics on non-vulnerable or mismatched memory layouts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply the vendor-provided patch for \u003ccode\u003ecifs.ko\u003c/code\u003e (upstream \u003ccode\u003e0ee150794c75\u003c/code\u003e, stable \u003ccode\u003efb736ab4fb8c\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eRestrict the ability of non-privileged users to mount SMB shares.\u003c/li\u003e\n\u003cli\u003eDisable the \u003ccode\u003ecifsacl\u003c/code\u003e and \u003ccode\u003emodefromsid\u003c/code\u003e mount options on production systems unless explicitly required and validated against trusted infrastructure.\u003c/li\u003e\n\u003cli\u003eMonitor kernel dmesg logs for unexpected panics occurring during SMB share access.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T14:37:33Z","date_published":"2026-10-29T14:37:33Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cifs-cve-2026-97555/","summary":"A heap buffer overflow in the Linux kernel SMB client (cifs.ko) allows a malicious SMB server to trigger an out-of-bounds write during DACL reconstruction, potentially enabling privilege escalation to root.","title":"Linux Kernel: cifs.ko Heap Overflow in id_mode_to_cifs_acl (CVE-2026-97555)","url":"https://feed.craftedsignal.io/briefs/2026-10-cifs-cve-2026-97555/"}],"language":"en","title":"CraftedSignal Threat Feed - Cifs.ko (Linux Kernel \u003c Patch 0ee150794c75)","version":"https://jsonfeed.org/version/1.1"}