The Linux kernel's SMB client did not correctly clear the setuid/setgid bits on files written over CIFS mounts with cifsacl, modefromsid, or SMB3.1.1 POSIX extensions enabled. The VFS strips these bits and issues a setattr with ATTR_KILL_SUID/ATTR_KILL_SGID and an ATTR_MODE with the cleared mode. However, the CIFS client functions cifs_setattr_unix() and cifs_setattr_nounix() unconditionally dropped ATTR_MODE when ATTR_KILL_SUID or ATTR_KILL_SGID were set, preventing the cleared mode from being sent to the server. This caused the setuid/setgid bits to persist on the server, contrary to local filesystem behavior, potentially allowing privilege escalation on subsequent execution. The fix involved modifying cifs_setattr_nounix() to only skip mode changes when the mode is emulated via the DOS read-only attribute and removing the shortcut in cifs_setattr_unix() to always push the cleared mode to the server.

The vulnerability allows setuid/setgid bits to persist on files after write operations over CIFS mounts with specific options, contrary to expected behavior where these bits are cleared. This persistence can lead to unexpected privilege escalation if a file with these bits set is executed, as the bits grant elevated privileges. The issue affects security by undermining the intended protection against privilege escalation on files accessed via SMB/CIFS mounts with the affected options.

A fix has been implemented in the Linux kernel to address this issue by ensuring the cleared setuid/setgid bits are properly propagated to the server in all relevant CIFS mount scenarios. Users should update to a kernel version that includes this fix. Since this is a kernel-level vulnerability, applying the official kernel patch or upgrading to a fixed kernel release is the recommended remediation.