CVE-2026-31710

Vulnerability

A logic error in the Linux kernel's SMB1 UNIX mount path causes the CIFS_MOUNT_POSIX_PATHS flag to be missing from cifs_sb_info::mnt_cifs_flags. The bug occurs in cifs_mount_get_tcon() when it reads or updates @cifs_sb->mnt_cifs_flags before calling reset_cifs_unix_caps(), instead of after. This results in the loss of both CIFS_MOUNT_POSIXACL and CIFS_MOUNT_POSIX_PATHS bits [1][2].

Exploitation

The vulnerability is triggered during the mount process of an SMB1 share with UNIX extensions enabled. No special privileges are required beyond the ability to mount a CIFS filesystem. An attacker who can control the server's response or influence the mount parameters could potentially cause the client to use an incorrect directory separator in all subsequent path operations.

Impact

With the CIFS_MOUNT_POSIX_PATHS bit missing, the kernel falls back to the default Windows-style backslash (\) separator instead of the POSIX forward slash (/). This mismatch can lead to file access failures, incorrect path resolution, and potential confusion in applications relying on POSIX path semantics. The missing CIFS_MOUNT_POSIXACL bit also disables POSIX ACL support, reducing security granularity.

Mitigation

The fix has been applied to the Linux kernel stable tree via commits [1] and [2]. Users should update to a kernel version containing these patches. No workaround is available other than avoiding SMB1 UNIX mounts or applying the kernel update.