The vulnerability occurs in the Linux kernel’s SMB client when administrator-provided forceuid or forcegid mount options are ignored during certain operations. In multiple code paths—stat via POSIX extensions, readdir via POSIX extensions, and CIFS ACL ownership mapping—the code unconditionally maps server‑supplied SIDs to local uid/gid values, overwriting the client‑specified forced identities. This flaw allows a malicious SMB server to dictate local file ownership on the client system, potentially enabling the execution of privileged actions or escalation of rights. The weakness represents an improper authorization problem that undermines the trust boundaries set by mount options.

The affected products are Linux kernel distributions that implement the SMB client. All releases of the Linux operating system that include the SMB client code are potentially impacted unless the vendor has applied the patch. No specific version numbers are listed in the CNA data, so administrators should verify that their kernel image incorporates the fix described in the advisory.

The CVSS score is 7.0 and the EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, an untrusted SMB server can influence local file ownership, which poses a significant risk to systems exposed to SMB shares. Exploitation requires the victim to mount a CIFS/SMB share with forceuid/forcegid enabled—an approach that is common in many shared‑workgroup scenarios. The fix removes the server's ability to override the mount‑specified identity, thereby eliminating this vector. In the absence of widely reported exploits, cautious assumption and prompt remediation are advised.