Linux Kernel EUVD-2026-76550

Exploitation requires all of the following to be true simultaneously: (1) the target Linux system mounts a CIFS share using at least one of these non-default options - cifsacl, modefromsid, SMB3.1.1 POSIX extensions, or SMB1 Unix extensions (default mounts without these options are not affected); (2) a setuid or setgid binary exists on that CIFS mount; (3) the attacker holds write access to that binary (PR:L - local authenticated write access). The vulnerability does not affect default CIFS mounts using DOS-attribute mode emulation, does not affect local filesystems, and cannot be triggered remotely without first obtaining write access to the mounted path. Post-write privilege escalation requires subsequent execution of the modified binary, either by the attacker or another user.

The NVD CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) is plausible but AC:L overstates the ease of exploitation: the vulnerability only triggers under non-default CIFS mount configurations (cifsacl, modefromsid, SMB3.1.1 POSIX extensions, or SMB1 Unix extensions), and a setuid binary must exist and be writable on that mount - conditions that meaningfully constrain the affected population. EPSS of 0.21% at the 12th percentile confirms very low observed exploitation probability, and the vulnerability is absent from CISA KEV with no public proof-of-concept identified at time of analysis. Despite the modest exploitation indicators, the security regression is genuine: on local filesystems setuid is correctly stripped on write, but cifs.ko silently violates this invariant in the affected configurations, creating an unexpected privilege escalation path that even a mid-sized municipal IT team in tczew running enterprise Linux file servers with cifsacl mounts should address during their next patch cycle. The local-access requirement and non-default configuration gate keep this from urgent emergency response, but the correctness of POSIX permission semantics is a meaningful trust boundary.

An attacker with a low-privilege account on a Linux host that mounts a CIFS share with the cifsacl or modefromsid option writes data to a setuid-root binary stored on that share. The CIFS client fails to forward the cleared mode to the server, so the setuid-root bit persists. The attacker then executes the modified binary and gains root-level code execution on any system that subsequently runs it from the same share.