This vulnerability involves the SMB client in Microsoft products, specifically related to clearing the setuid/setgid bits on write operations when using cifsacl, modefromsid, or POSIX extensions. The advisory does not provide detailed impact or exploitation information.

smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions

linux

linux-aws

linux-azure

linux-lts-xenial

linux-aws-hwe

linux-gcp

linux-hwe

linux-hwe-edge

linux-kvm

linux-oracle

linux-fips

linux-aws-5.0

linux-aws-5.3

linux-aws-5.4

linux-azure-4.15

linux-azure-5.3

linux-azure-5.4

linux-azure-edge

linux-gcp-4.15

linux-gcp-5.3

linux-gcp-5.4

linux-gke-4.15

linux-gke-5.4

linux-gkeop-5.4

linux-hwe-5.4

linux-ibm-5.4

linux-oem

linux-oracle-5.0

linux-oracle-5.3

linux-oracle-5.4

linux-raspi-5.4

linux-aws-fips

linux-azure-fips

linux-gcp-fips

linux-aws-5.11

linux-aws-5.13

linux-aws-5.15

linux-aws-5.8

linux-azure-5.11

linux-azure-5.13

linux-azure-5.15

linux-azure-5.8

linux-azure-fde

linux-azure-fde-5.15

linux-bluefield

linux-gcp-5.11

linux-gcp-5.13

linux-gcp-5.15

linux-gcp-5.8

linux-gke

linux-gke-5.15

linux-gkeop

linux-gkeop-5.15

linux-hwe-5.11

linux-hwe-5.13

linux-hwe-5.15

linux-hwe-5.8

linux-ibm

linux-ibm-5.15

linux-intel-5.13

linux-intel-iotg-5.15

linux-iot

linux-lowlatency-hwe-5.15

linux-nvidia-tegra-5.15

linux-oem-5.10

linux-oem-5.13

linux-oem-5.14

linux-oem-5.6

linux-oracle-5.11

linux-oracle-5.13

linux-oracle-5.15

linux-oracle-5.8

linux-raspi

linux-raspi2

linux-riscv

linux-riscv-5.11

linux-riscv-5.15

linux-riscv-5.8

A vulnerability in the Linux kernel's CIFS client implementation caused the setuid and setgid bits on files to persist after writes when using certain mount options (cifsacl, modefromsid, or SMB3.1.1 POSIX extensions). Normally, these bits are cleared on write to prevent privilege escalation, but due to improper handling of mode attributes, the cleared bits were not propagated to the server, allowing the bits to survive and potentially enable privilege escalation. This issue affects specific Linux kernel versions and has been resolved by ensuring the cleared mode is properly pushed to the server in all relevant cases.

CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions in Linux kernel

CVE-2026-89638 is a vulnerability in the Linux kernel's SMB client implementation where the setuid/setgid bits on files are not properly cleared on write when using cifsacl, modefromsid, or POSIX extensions. This flaw allows the setuid/setgid bits to persist on the server after a file write, contrary to expected behavior on local filesystems where these bits are stripped. This persistence can lead to unexpected privilege escalation upon subsequent execution of the affected files.

CVE-2026-89638 is a vulnerability in the Linux kernel's SMB client implementation where the setuid/setgid bits on files are not properly cleared on write operations when using cifsacl, modefromsid, or POSIX extensions. This causes the setuid/setgid bits to persist on the server, contrary to local filesystem behavior, potentially allowing privilege escalation on subsequent execution.

Search: CVE-2026-89638