CVE-2024-26822

smb: client: set correct id, uid and cruid for multiuser automounts

State: Published
Severity: 8.7 High
Published: Apr 17, 2024
Updated: Aug 5, 2026
Reserved: Feb 19, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: set correct id, uid and cruid for multiuser automounts

When uid, gid and cruid are not specified, we need to dynamically set them into the filesystem context used for automounting otherwise they'll end up reusing the values from the parent mount.

Scores

CVSS	Score	Vector	Source
3.1	8.7 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c8117ac42303f7ae99bbe53e4952f7d147cca1fb to before 4a6e4c56721a3e6e2550b72ec56aab306c4607a7Affected 60e3318e3e900ba1ddfead937012b3432dfccc92 to before 2ceba8ae1bd1f5589548cb722a5c583ca3a2dedeAffected 9fd29a5bae6e8f94b410374099a6fddb253d2d5f to before c2aa2718cda2d56b4a551cb40043e9abc9684626Affected 9fd29a5bae6e8f94b410374099a6fddb253d2d5f to before 7590ba9057c6d74c66f3b909a383ec47cd2f27fbAffected 9fd29a5bae6e8f94b410374099a6fddb253d2d5f to before 4508ec17357094e2075f334948393ddedbb75157Affected 5.15.124 to before 5.15.201Affected 6.1.54 to before 6.1.164Affected
LinuxLinux	6.2Affected before 6.2Not affected 5.15.201 through 5.15.Not affected 6.1.164 through 6.1.Not affected 6.6.18 through 6.6.Not affected 6.7.6 through 6.7.Not affected 6.8 and laterNot affected

Product

Versions

LinuxLinux

c8117ac42303f7ae99bbe53e4952f7d147cca1fb to before 4a6e4c56721a3e6e2550b72ec56aab306c4607a7Affected
60e3318e3e900ba1ddfead937012b3432dfccc92 to before 2ceba8ae1bd1f5589548cb722a5c583ca3a2dedeAffected
9fd29a5bae6e8f94b410374099a6fddb253d2d5f to before c2aa2718cda2d56b4a551cb40043e9abc9684626Affected
9fd29a5bae6e8f94b410374099a6fddb253d2d5f to before 7590ba9057c6d74c66f3b909a383ec47cd2f27fbAffected
9fd29a5bae6e8f94b410374099a6fddb253d2d5f to before 4508ec17357094e2075f334948393ddedbb75157Affected
5.15.124 to before 5.15.201Affected
6.1.54 to before 6.1.164Affected

LinuxLinux

6.2Affected
before 6.2Not affected
5.15.201 through 5.15.*Not affected
6.1.164 through 6.1.*Not affected
6.6.18 through 6.6.*Not affected
6.7.6 through 6.7.*Not affected
6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.