VulnerabilityPublished 25 Sep 2026Updated 30 Oct 2026

CVE-2026-97554: Linux kernel · smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()

Source GCVE Database

Compare

Authoritative record:CVE-2026-97554· Medium

Not known to be exploited · fixed in da6e25842431982d5a53cf00d925b98c690f4467 : update Linux kernel when convenient.

Data as of 30 Oct 2026, 17:33 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in da6e25842431982d5a53cf00d925b98c690f4467, c9a8b60ce140a68d172452f418137fc7ddbae7db, 33106019c3be57b5fc6411cfaad6d98214a51265 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-vfwc-r92w-jp29

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=5.8.17 <5.9 >=5.9.2 <5.10	Fixed in da6e25842431982d5a53cf00d925b98c690f4467 c9a8b60ce140a68d172452f418137fc7ddbae7db 33106019c3be57b5fc6411cfaad6d98214a51265 1915b69e36906968e2b698699d0f219875ae846e 604feb3e8141bf11f5afd48d36d401fee5af9536 5.10 5.9 2be31f252ade791b84f7164991f14436aed1d4b9
LinuxLinux	Affected =5.10	Fixed in–

AI-suggested

A fix has been implemented that checks the return value of posix_info_parse() and avoids using uninitialized SIDs when parsing fails. Users should apply the official Linux kernel update containing this fix once available. Until then, caution is advised when connecting to untrusted SMB servers. No additional mitigations are specified.

Description

CVE-2026-97554 is a vulnerability in the Linux kernel SMB client where uninitialized Security Identifiers (SIDs) may be used in the cifs_posix_to_fattr() function. This occurs because the function ignores the failure return value of posix_info_parse(), leading to potential leakage of kernel stack memory to userspace when parsing malformed POSIX directory entries from untrusted servers. The issue is fixed by checking the return value and skipping SID-to-id mapping on parse failure.

Impact

An attacker controlling an untrusted SMB server could send malformed POSIX directory entries causing the client to use uninitialized stack memory as SIDs. This may result in leakage of kernel stack memory contents to userspace, potentially exposing sensitive kernel data. There is no indication of remote code execution or privilege escalation from this vulnerability. No known exploits are reported in the wild.

References

Community reviews

Loading reviews…