SB20260912145 - Improper Preservation of Permissions in Linux kernel smb client

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Preservation of Permissions (CVE-ID: CVE-2026-89638)

CWE-ID: CWE-281 - Improper preservation of permissions

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper preservation of permissions in the cifs_setattr_unix() and cifs_setattr_nounix() routines when processing writes to files with setuid or setgid bits set. A local user can write to such a file and retain its setuid or setgid bits on the server to escalate privileges.

The issue occurs when the mount stores modes on the server through cifsacl or modefromsid, SMB3.1.1 POSIX extensions, or SMB1 Unix extensions.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/69bfe810ecd1e0387d8975d711cd326341d13c6e
• https://git.kernel.org/stable/c/b10015807e4c628095d1d1d1c9307efc8cdd9e1b
• https://git.kernel.org/stable/c/b8e5dc4f95e5484159b343903f302eb6d783f2e6