A vulnerability in the Linux kernel SMB client allows local attackers to bypass security restrictions regarding setuid and setgid bits, resulting in potential local privilege escalation.

This is an improper privilege management flaw occurring when using cifsacl, modefromsid, or POSIX extensions. The kernel incorrectly drops the mode update during file writes, allowing local authenticated users to retain elevated setuid or setgid bits that should have been cleared by the VFS.

The flaw carries a CVSS score of 7.8, reflecting a high-severity risk for local environments. Successful exploitation allows a local user to maintain elevated permissions on files, which can be leveraged to gain unauthorized access to sensitive data or escalate privileges to the level of the file owner. This could lead to a compromise of system integrity and confidentiality in multi-user or containerized environments using SMB network shares.

Immediate Action: Update the Linux kernel to version 6.18.51, 7.2.4, or later versions where the fix has been backported.

Proactive Monitoring: Monitor system logs for unusual file permission changes or unauthorized attempts to execute files with setuid/setgid bits enabled in SMB-mounted directories.

Compensating Controls: If patching is delayed, restrict the use of mount options such as cifsacl, modefromsid, and POSIX extensions on untrusted or shared network storage segments.

Public Exploit Available: No — exploit_available (unknown).