UBUNTU-CVE-2026-97554: Low severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid using uninitialized SIDs in cifsposixtofattr() cifsposixtofattr() ignores the return value of posixinfoparse(). When a malformed POSIX directory entry is encountered (e.g. invalid SID lengths from an untrusted server), posixinfoparse() returns -1 without populating the 'parsed' struct. The uninitialized stack memory in parsed.owner and parsed.group is then passed to sidtoid(), which processes the garbage bytes and passes them to requestkey() to construct a SID string, potentially leaking kernel stack contents to the userspace idmap daemon. Fix this by checking the return value and skipping the SID-to-id mapping when parsing fails. The remaining fattr fields (timestamps, mode, etc.) are populated directly from the 'info' pointer so they are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In cifs_posix_to_fattr(), check the return value of posix_info_parse() and skip SID-to-id mapping when parsing fails, so uninitialized parsed.owner and parsed.group values are not passed to sid_to_id().
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux, ubuntu/linux-fips, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, ubuntu/linux-gcp, and ubuntu/linux-gcp-fips.
What must an attacker control to trigger the issue?
An attacker needs to provide a malformed POSIX directory entry through an untrusted SMB server, such as one containing invalid SID lengths. Exploitation relies on the SMB client processing that entry.
What data could be exposed if exploitation succeeds?
Uninitialized kernel stack bytes from the parsed owner and group SID fields may be incorporated into a SID string and sent to the userspace idmap daemon via request_key(). The issue is described as a potential kernel stack information leak rather than an integrity impact.