The Linux clearing of setuid and setgid bits when a file is written while mounted with certain option sets such as cifsacl, modefromsid, or SMB3.1.1 POSIX extensions. The client removes the bits locally and sends a request to kill them on the server, but at the same time it drops the accompanying mode change from the attributes. As a result, the server never receives the cleared mode, and the setuid/setgid bits persist on the server copy of the file. This flaw allows an attacker who can write to a CIFS share to keep privileged bits on a file after a write operation, creating a privilege‑escalation path when the file is later executed under a higher‑privilege user.

The vulnerability affects Linux systems that run the kernel with the CIFS client enabled and mount Windows shares using the cifsacl or modefromsid options, or the SMB3.1.1 POSIX extensions. All kernels prior to the patch that implements the two fixes described in the kernel change log are vulnerable, regardless of distribution or kernel release level. The issue resides in attribute propagation.

The CVSS score of 7.3 indicates a medium‑to‑high severity. An EPSS score of 0.00213 (<1%) is recorded, and the vulnerability is not listed in CISA’s KEV catalog, the likelihood of exploitation in the wild is uncertain, but the attack surface is defined: a remote adversary must have write access to a CIFS share that is mounted with the affected options and then execute the file to gain escalated privileges. No publicly disclosed exploits are known at this time, yet the mechanism is straightforward and could be used by an attacker who already has limited access to the share.