CVE-2026-97561: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid
In the Linux kernel, the following vulnerability has been resolved:
smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid
When the administrator mounts with forceuid or forcegid (uid=/gid= mount options), they expect all files to appear owned by the specified user/group. However, several code paths unconditionally called sidtoid() to overwrite cfuid/cfgid with server-provided values, ignoring the administrator's explicit override:
- smb311posixinfotofattr() (stat via POSIX extensions) - cifsposixtofattr() (readdir via POSIX extensions) - parsesecdesc() (CIFS ACL ownership mapping)
This allowed an untrusted server to dictate local file ownership even when the mount was configured to force specific uid/gid values.
Fix all three call sites to check CIFSMOUNTOVERRUID and CIFSMOUNTOVERRGID before calling sidtoid(), following the same pattern already used by cifsunixbasictofattr() for unix extensions.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems mounting SMB/CIFS shares with the uid= or gid= options, which enable forceuid or forcegid behavior, are exposed when they interact with an untrusted SMB server. The affected paths include POSIX-extension stat and directory reads, as well as CIFS ACL ownership mapping.
What must an attacker control to exploit it?
An attacker needs to control, or cause the client to connect to, an SMB server that supplies SID ownership information. The server can then provide ownership values that overwrite the client administrator's requested forced UID or GID in the affected paths.
Are mounts without forced UID or GID overrides affected in the same way?
The described issue specifically concerns mounts configured with uid= and/or gid= options, where the administrator expects ownership to be forced locally. The data does not indicate that mounts without those override options violate an equivalent forced-ownership expectation.
How can I determine whether a mount needs remediation?
Check SMB/CIFS mount configurations for uid= or gid= options and identify whether the mounted server is untrusted. Affected behavior can occur during POSIX-extension metadata operations or CIFS ACL ownership mapping, where server-provided SID mappings may appear as local file ownership despite the configured override.