UBUNTU-CVE-2026-99110: Medium severity vulnerability
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in cifsdosetacl() cifssetacl() validates ACL size using posixaclxattrsize(): 4 + (count 8) // 4-byte header + 8 bytes per ACE cifsdosetacl() then calls posixacltocifs() to write the CIFS wire format into the same buffer: 6 + (count 10) // 6-byte header + 10 bytes per ACE An ACL that passes the xattr-based check in cifssetacl() can overflow the heap when posixacltocifs() writes the larger CIFS format. Validate the CIFS format size against the remaining buffer space and USHRTMAX before converting--datacount is u16, so sizes above USHRTMAX truncate the on-wire packet length, causing the server to apply a partial ACL. Replace MaxDataCount = 1000 with min(CIFSMaxBufSize, USHRTMAX).
Event History
Frequently Asked Questions
What ACL sizes are dangerous in this code path?
ACLs that pass the POSIX xattr size validation can still require more space when encoded in CIFS wire format. The CIFS representation uses a 6-byte header and 10 bytes per ACE, rather than the 4-byte header and 8 bytes per ACE used by the earlier check.
What additional issue occurs for oversized CIFS ACL data?
The CIFS data count is a 16-bit field. Sizes above USHRT_MAX can truncate the on-wire length, which can cause the server to apply only a partial ACL.
What validation does the fix add?
The fix validates the CIFS-format size against the remaining buffer space and USHRT_MAX before conversion. It also limits MaxDataCount to the smaller of CIFSMaxBufSize and USHRT_MAX.