CVE-2026-97554

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97554", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.154Z", "datePublished": "2026-09-25T10:21:45.851Z", "dateUpdated": "2026-10-30T12:37:18.935Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:37:18.935Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()\n\ncifs_posix_to_fattr() ignores the return value of posix_info_parse().\nWhen a malformed POSIX directory entry is encountered (e.g. invalid\nSID lengths from an untrusted server), posix_info_parse() returns -1\nwithout populating the 'parsed' struct. The uninitialized stack\nmemory in parsed.owner and parsed.group is then passed to\nsid_to_id(), which processes the garbage bytes and passes them to\nrequest_key() to construct a SID string, potentially leaking kernel\nstack contents to the userspace idmap daemon.\n\nFix this by checking the return value and skipping the SID-to-id\nmapping when parsing fails. The remaining fattr fields (timestamps,\nmode, etc.) are populated directly from the 'info' pointer so they\nare unaffected."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/readdir.c"], "versions": [{"version": "9934430e2178d5164eb1ac91a9b092f9e7e64745", "lessThan": "1915b69e36906968e2b698699d0f219875ae846e", "status": "affected", "versionType": "git"}, {"version": "9934430e2178d5164eb1ac91a9b092f9e7e64745", "lessThan": "604feb3e8141bf11f5afd48d36d401fee5af9536", "status": "affected", "versionType": "git"}, {"version": "9934430e2178d5164eb1ac91a9b092f9e7e64745", "lessThan": "33106019c3be57b5fc6411cfaad6d98214a51265", "status": "affected", "versionType": "git"}, {"version": "9934430e2178d5164eb1ac91a9b092f9e7e64745", "lessThan": "2be31f252ade791b84f7164991f14436aed1d4b9", "status": "affected", "versionType": "git"}, {"version": "9934430e2178d5164eb1ac91a9b092f9e7e64745", "lessThan": "c9a8b60ce140a68d172452f418137fc7ddbae7db", "status": "affected", "versionType": "git"}, {"version": "9934430e2178d5164eb1ac91a9b092f9e7e64745", "lessThan": "da6e25842431982d5a53cf00d925b98c690f4467", "status": "affected", "versionType": "git"}, {"version": "dd80b98bdf0a4b3206739f3513b0518f27a7b4ef", "status": "affected", "versionType": "git"}, {"version": "d8e39c11f66125f49de55537a6efc8ecadf4a0f7", "status": "affected", "versionType": "git"}, {"version": "5.8.17", "lessThan": "5.9", "status": "affected", "versionType": "semver"}, {"version": "5.9.2", "lessThan": "5.10", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/readdir.c"], "versions": [{"version": "5.10", "status": "affected"}, {"version": "0", "lessThan": "5.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1915b69e36906968e2b698699d0f219875ae846e"}, {"url": "https://git.kernel.org/stable/c/604feb3e8141bf11f5afd48d36d401fee5af9536"}, {"url": "https://git.kernel.org/stable/c/33106019c3be57b5fc6411cfaad6d98214a51265"}, {"url": "https://git.kernel.org/stable/c/2be31f252ade791b84f7164991f14436aed1d4b9"}, {"url": "https://git.kernel.org/stable/c/c9a8b60ce140a68d172452f418137fc7ddbae7db"}, {"url": "https://git.kernel.org/stable/c/da6e25842431982d5a53cf00d925b98c690f4467"}], "title": "smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/readdir.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1915b69e36906968e2b698699d0f219875ae846e", "status": "affected", "version": "9934430e2178d5164eb1ac91a9b092f9e7e64745", "versionType": "git"}, {"lessThan": "604feb3e8141bf11f5afd48d36d401fee5af9536", "status": "affected", "version": "9934430e2178d5164eb1ac91a9b092f9e7e64745", "versionType": "git"}, {"lessThan": "33106019c3be57b5fc6411cfaad6d98214a51265", "status": "affected", "version": "9934430e2178d5164eb1ac91a9b092f9e7e64745", "versionType": "git"}, {"lessThan": "2be31f252ade791b84f7164991f14436aed1d4b9", "status": "affected", "version": "9934430e2178d5164eb1ac91a9b092f9e7e64745", "versionType": "git"}, {"lessThan": "c9a8b60ce140a68d172452f418137fc7ddbae7db", "status": "affected", "version": "9934430e2178d5164eb1ac91a9b092f9e7e64745", "versionType": "git"}, {"lessThan": "da6e25842431982d5a53cf00d925b98c690f4467", "status": "affected", "version": "9934430e2178d5164eb1ac91a9b092f9e7e64745", "versionType": "git"}, {"status": "affected", "version": "dd80b98bdf0a4b3206739f3513b0518f27a7b4ef", "versionType": "git"}, {"status": "affected", "version": "d8e39c11f66125f49de55537a6efc8ecadf4a0f7", "versionType": "git"}, {"lessThan": "5.9", "status": "affected", "version": "5.8.17", "versionType": "semver"}, {"lessThan": "5.10", "status": "affected", "version": "5.9.2", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/readdir.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.10"}, {"lessThan": "5.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()\n\ncifs_posix_to_fattr() ignores the return value of posix_info_parse().\nWhen a malformed POSIX directory entry is encountered (e.g. invalid\nSID lengths from an untrusted server), posix_info_parse() returns -1\nwithout populating the 'parsed' struct. The uninitialized stack\nmemory in parsed.owner and parsed.group is then passed to\nsid_to_id(), which processes the garbage bytes and passes them to\nrequest_key() to construct a SID string, potentially leaking kernel\nstack contents to the userspace idmap daemon.\n\nFix this by checking the return value and skipping the SID-to-id\nmapping when parsing fails. The remaining fattr fields (timestamps,\nmode, etc.) are populated directly from the 'info' pointer so they\nare unaffected."}], "id": "CVE-2026-97554", "lastModified": "2026-10-30T13:21:07.387", "metrics": {}, "published": "2026-09-25T11:17:05.860", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1915b69e36906968e2b698699d0f219875ae846e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2be31f252ade791b84f7164991f14436aed1d4b9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/33106019c3be57b5fc6411cfaad6d98214a51265"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/604feb3e8141bf11f5afd48d36d401fee5af9536"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c9a8b60ce140a68d172452f418137fc7ddbae7db"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/da6e25842431982d5a53cf00d925b98c690f4467"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()", "id": "2541276", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541276"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-908", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsmb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()\ncifs_posix_to_fattr() ignores the return value of posix_info_parse().\nWhen a malformed POSIX directory entry is encountered (e.g. invalid\nSID lengths from an untrusted server), posix_info_parse() returns -1\nwithout populating the 'parsed' struct. The uninitialized stack\nmemory in parsed.owner and parsed.group is then passed to\nsid_to_id(), which processes the garbage bytes and passes them to\nrequest_key() to construct a SID string, potentially leaking kernel\nstack contents to the userspace idmap daemon.\nFix this by checking the return value and skipping the SID-to-id\nmapping when parsing fails. The remaining fattr fields (timestamps,\nmode, etc.) are populated directly from the 'info' pointer so they\nare unaffected.", "A flaw was found in the Linux kernel's Server Message Block (SMB) client. When handling malformed directory entries with invalid security identifiers, the client fails to verify whether data parsing succeeded before processing file attributes. A malicious or compromised server could exploit this issue to pass uninitialized kernel stack memory to user space services, resulting in information disclosure."], "name": "CVE-2026-97554", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97554\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97554\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97554.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": ["*"], "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c9a8b60ce140a68d172452f418137fc7ddbae7db)"}}, {"platform": ["*"], "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,da6e25842431982d5a53cf00d925b98c690f4467)"}}, {"platform": ["*"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,7.2.7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": ["*"], "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.7,7.2.*]"}}, {"platform": ["*"], "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T13:15:07.881664+00:00", "updated": "2026-10-01T10:15:06.448205+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}