CVE-2026-89638 Overview
CVE-2026-89638 is a Linux kernel vulnerability in the SMB/CIFS client that fails to strip setuid and setgid bits from files written over mounts using the cifsacl, modefromsid, SMB3.1.1 POSIX extensions, or SMB1 Unix extensions. When the VFS layer issues a setattr with ATTR_KILL_SUID or ATTR_KILL_SGID, both cifs_setattr_unix() and cifs_setattr_nounix() unconditionally drop the ATTR_MODE change. The cleared mode is never pushed to the server, so the privileged bits persist on remote files after modification.
Critical Impact
Attackers with local write access to setuid/setgid files on affected CIFS mounts can preserve privileged bits after tampering with executable contents, enabling local privilege escalation on subsequent execution.
Affected Products
- Linux kernel smb/client (cifs.ko) with cifsacl mount option
- Linux kernel smb/client (cifs.ko) with modefromsid mount option
- Linux kernel smb/client (cifs.ko) with SMB3.1.1 POSIX extensions or SMB1 Unix extensions enabled
Discovery Timeline
- 2026-09-11 - CVE-2026-89638 published to NVD
- 2026-09-13 - Last updated in NVD database
Technical Details for CVE-2026-89638
Vulnerability Analysis
The Linux Virtual File System (VFS) enforces a standard security invariant: when an unprivileged user writes to a file carrying setuid or setgid bits, the kernel strips those bits to prevent trust inheritance across content changes. The VFS signals this by issuing a setattr call with ATTR_KILL_SUID or ATTR_KILL_SGID flags alongside an ATTR_MODE field containing the already-cleared mode.
The cifs client intercepts this call in cifs_setattr_unix() and cifs_setattr_nounix() and applies the following shortcut:
/* skip mode change if it's just for clearing setuid/setgid */
if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID))
attrs->ia_valid &= ~ATTR_MODE;
This shortcut is only safe when the mode is emulated locally through the DOS read-only attribute. With cifsacl or modefromsid, the mode is stored server-side via id_mode_to_cifs_acl(). With SMB3.1.1 POSIX extensions or SMB1 Unix extensions, the mode is transmitted directly (for example, through CIFSSMBUnixSetPathInfo()). In these modes, discarding ATTR_MODE prevents the cleared bits from ever reaching the server.
Root Cause
The root cause is an unconditional optimization that assumes mode information is not persisted server-side. The check does not verify whether the active mount uses ACL translation, modefromsid, or POSIX/Unix extensions, all of which push mode changes to the server.
Attack Vector
Exploitation requires local access with write permission to a setuid or setgid file residing on a CIFS mount configured with cifsacl, modefromsid, or SMB POSIX/Unix extensions. An attacker overwrites the file body with malicious code, the VFS attempts to strip privileged bits, the cifs client silently discards the mode update, and the file retains its original setuid/setgid ownership escalation. Subsequent execution runs attacker-controlled code with elevated privileges.
Detection Methods for CVE-2026-89638
Indicators of Compromise
- setuid or setgid files on CIFS-mounted shares whose content modification time is later than expected, while retaining privileged mode bits
- Unexpected privilege escalations traced to binaries stored on network shares mounted with cifsacl, modefromsid, or POSIX extensions
- Audit events showing writes to setuid files on CIFS mounts without a corresponding server-side ACL or mode change
Detection Strategies
- Enumerate CIFS mounts using mount -t cifs and identify those configured with cifsacl, modefromsid, or posix options
- Run periodic find <cifs-mount> -perm /6000 -type f sweeps and correlate results against a baseline of authorized setuid/setgid binaries
- Enable kernel audit rules on execve events targeting binaries on CIFS shares and alert on UID transitions to root or privileged groups
Monitoring Recommendations
- Forward Linux auditd telemetry covering setuid executions and CIFS mount activity to a centralized analytics platform for correlation
- Track kernel version inventory across Linux hosts mounting SMB shares to prioritize patch rollout
- Monitor SMB server-side ACL change logs for absence of expected mode updates after client-side write operations
How to Mitigate CVE-2026-89638
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the kernel.org commits that fix cifs_setattr_unix() and cifs_setattr_nounix()
- Audit CIFS mount options across the fleet and identify hosts using cifsacl, modefromsid, or POSIX/Unix extensions
- Review existing setuid and setgid binaries on affected shares and reset mode bits to intended values
Patch Information
The fix modifies cifs_setattr_nounix() to only take the mode-skip shortcut when the mode is emulated via the DOS read-only attribute, and removes the shortcut entirely from cifs_setattr_unix(). Verified fix commits are available at kernel.org commit 69bfe810, kernel.org commit b1001580, and kernel.org commit b8e5dc4f.
Workarounds
- Remount affected CIFS shares without cifsacl, modefromsid, or POSIX/Unix extensions until patching is complete, accepting the loss of server-side mode fidelity
- Mount CIFS shares with the nosuid option to prevent setuid/setgid semantics from taking effect on execution
- Restrict write access to existing setuid and setgid binaries on CIFS mounts through server-side ACL hardening
# Example: remount a CIFS share with nosuid to neutralize the risk
mount -o remount,nosuid /mnt/share
# Or replace cifsacl with default mode emulation until patched
mount -t cifs //server/share /mnt/share -o username=user,nosuid
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
