CVE-2026-64379: smb: client: mask server-provided mode to 07777 in modefromsid

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

smb: client: mask server-provided mode to 07777 in modefromsid

When modefromsid is active, parse_dacl() applies the server-provided
sub_auth[2] value from the NFS mode SID to cf_mode without masking to
07777. Apply the correct masking, same as in the read path.

The Linux kernel CVE team has assigned CVE-2026-64379 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.4 with commit e2f8fbfb8d09c06decde162090fac3ee220aa280 and fixed in 5.10.261 with commit 5f6f2241034f189c69d4d0b5f8fe24a0c25b0c14
	Issue introduced in 5.4 with commit e2f8fbfb8d09c06decde162090fac3ee220aa280 and fixed in 5.15.212 with commit ee2216dbdf0c677e89bb43e03247dba590ed00ef
	Issue introduced in 5.4 with commit e2f8fbfb8d09c06decde162090fac3ee220aa280 and fixed in 6.1.178 with commit f511807feee7cb29b61bdfa86472c7e9e2e5df94
	Issue introduced in 5.4 with commit e2f8fbfb8d09c06decde162090fac3ee220aa280 and fixed in 6.6.145 with commit 08c600b7e1818539ba5efee4cdb06215c245ca78
	Issue introduced in 5.4 with commit e2f8fbfb8d09c06decde162090fac3ee220aa280 and fixed in 6.12.96 with commit b84e002e0df26bbc6cbd3ca01b8212601fe0ae7d
	Issue introduced in 5.4 with commit e2f8fbfb8d09c06decde162090fac3ee220aa280 and fixed in 6.18.39 with commit c6c484a7d5bff6b929a86d7ed5130f29834c6a0d
	Issue introduced in 5.4 with commit e2f8fbfb8d09c06decde162090fac3ee220aa280 and fixed in 7.1.4 with commit f80add1bfb3425100a325b14f19648e75669a954
	Issue introduced in 5.4 with commit e2f8fbfb8d09c06decde162090fac3ee220aa280 and fixed in 7.2-rc3 with commit e3d9c7160d483fc8f9e225aafad8ecbbc43f3151

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64379
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/smb/client/cifsacl.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/5f6f2241034f189c69d4d0b5f8fe24a0c25b0c14
	https://git.kernel.org/stable/c/ee2216dbdf0c677e89bb43e03247dba590ed00ef
	https://git.kernel.org/stable/c/f511807feee7cb29b61bdfa86472c7e9e2e5df94
	https://git.kernel.org/stable/c/08c600b7e1818539ba5efee4cdb06215c245ca78
	https://git.kernel.org/stable/c/b84e002e0df26bbc6cbd3ca01b8212601fe0ae7d
	https://git.kernel.org/stable/c/c6c484a7d5bff6b929a86d7ed5130f29834c6a0d
	https://git.kernel.org/stable/c/f80add1bfb3425100a325b14f19648e75669a954
	https://git.kernel.org/stable/c/e3d9c7160d483fc8f9e225aafad8ecbbc43f3151