Improper access control in Linux kernel - CVE-2026-97561
Published: September 28, 2026
Vulnerability identifier: #VU152650
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-97561
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to control local file ownership.
The vulnerability exists due to improper access control in the Linux kernel CIFS/SMB client SID-to-UID/GID mapping logic when processing SMB server-provided SID ownership data. A remote attacker can provide SID ownership values to control local file ownership.
Only mounts configured with the forceuid or forcegid mount options are affected.
Affected software
Linux kernel
How to mitigate CVE-2026-97561
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3