Linux Kernel EUVD-2026-86863

Requires an SMB/CIFS share mounted with the cifsacl or modefromsid mount option (both non-default), and a local ACL-modifying operation (chown/chmod) that invokes id_mode_to_cifs_acl to rewrite an existing DACL. The overflow only occurs when the original on-disk DACL holds short SIDs (e.g., 1 sub-authority) while the cifs.idmap upcall returns long replacement SIDs (up to 15 sub-authorities); a benign or attacker-influenced SMB server / idmap mapping controls the SID lengths. Limiting factors: the affected code path is gated behind these specific mount options, exploitation is local (not against a network-listening service despite AV:N in the source vector), and the realistic outcome is kernel memory corruption/crash rather than confirmed code execution or data disclosure.

The NVD/Linux vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) overstates real-world risk and is internally inconsistent with the description. This is a heap out-of-bounds WRITE in the in-kernel SMB/CIFS client (build_sec_desc → id_mode_to_cifs_acl), triggered by a local chown/chmod operation on a share mounted with the cifsacl or modefromsid options - the KASAN report explicitly shows 'task chown/5298'. It is not a remote-unauthenticated network flaw against a listening service, so AV:N/PR:N/UI:R misrepresents the actual trigger path: an authenticated local user (or a malicious/crafted SMB server whose idmap upcall returns long SIDs) is required. C:H/I:H/A:H is aspirational: the primary and reliable outcome is kernel memory corruption / crash (A:H); the write is a controlled slab overflow that could in principle be developed into escalation, but the CVE data shows only a KASAN slab-out-of-bounds, not demonstrated info-leak or code execution. No EPSS score, no CISA KEV listing, and no public exploit are provided - this is a routine stable-tree kernel hardening fix with no signals of active or imminent exploitation. My independent assessment is ~5.0 (medium): a niche configuration-gated local DoS/memory-corruption bug, not a network RCE priority. Missing data: no CWE assigned by the source (it is effectively CWE-787/122 heap overflow), and no EPSS/SSVC provided.

A system mounts an SMB/CIFS share with the cifsacl or modefromsid option and a local user runs chown or chmod on a file whose on-disk DACL contains short SIDs (few sub-authorities). During the ACL rewrite, the cifs.idmap upcall supplies replacement owner/group SIDs with up to 15 sub-authorities, so the rewritten ACEs (up to 76 bytes each) overrun the buffer sized from the original DACL length, corrupting adjacent kernel slab memory and typically panicking the machine. No public exploit code is available; the flaw was found via KASAN instrumentation.