Cifs.ko (Linux Kernel < Patch 0ee150794c75) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/cifs.ko-linux-kernel--patch-0ee150794c75/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 14:37:33 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLinux Kernel: cifs.ko Heap Overflow in id_mode_to_cifs_acl (CVE-2026-97555)https://feed.craftedsignal.io/briefs/2026-10-cifs-cve-2026-97555/Thu, 29 Oct 2026 14:37:33 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cifs-cve-2026-97555/A heap buffer overflow in the Linux kernel SMB client (cifs.ko) allows a malicious SMB server to trigger an out-of-bounds write during DACL reconstruction, potentially enabling privilege escalation to root.A heap-based buffer overflow exists in the Linux kernel cifs.ko module, specifically within the id_mode_to_cifs_acl() function. The vulnerability occurs when the client attempts to rewrite Access Control Entries (ACEs) while replacing owner/group Security Identifiers (SIDs). An attacker-controlled SMB server can provide a specially crafted DACL that causes the rewritten security descriptor to grow larger than the pre-allocated kernel heap buffer. This results in an out-of-bounds write past the slab object. An exploit has been published demonstrating a full chain from memory corruption to a uid-0 shell on Android 16 GKI-based 6.12 kernels.

Attack Chain

  1. Share Setup - The attacker configures a malicious SMB2/3 server capable of providing custom DACL layouts (cross7).
  2. Mounting - The victim system mounts the attacker-controlled share using cifsacl and modefromsid mount options.
  3. Trigger - The attacker initiates a chown operation on a file within the share, causing the kernel to call id_mode_to_cifs_acl().
  4. Overflow - The kernel calculates an allocation size that is insufficient for the rewritten DACL, resulting in a heap buffer overflow.
  5. Heap Grooming - The overflow overwrites adjacent kernel objects; the published exploit uses pipe_buffer arrays to gain memory corruption primitives.
  6. KASLR Leak - The overflow modifies a key payload, allowing the attacker to dump memory and calculate the KASLR slide.
  7. Privilege Escalation - The attacker reclaims page-table pages to write arbitrary PTEs, ultimately modifying the current task's cred structure to escalate to uid 0.

Impact

Confirmed local privilege escalation to uid 0 (root) on reference environments (Android 16 GKI-based 6.12). The out-of-bounds write is observable by the malicious SMB server and can cause kernel panics on non-vulnerable or mismatched memory layouts.

Recommendation

  • Apply the vendor-provided patch for cifs.ko (upstream 0ee150794c75, stable fb736ab4fb8c).
  • Restrict the ability of non-privileged users to mount SMB shares.
  • Disable the cifsacl and modefromsid mount options on production systems unless explicitly required and validated against trusted infrastructure.
  • Monitor kernel dmesg logs for unexpected panics occurring during SMB share access.
]]>highadvisorylinuxkernelprivilege-escalationcve-2026-97555