{"schema":"threatline.record/2","record":{"id":"CVE-2026-93785","aliases":[],"summary":"cifs: validate idmap key payload length","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: validate idmap key payload length\n\nThe cifs.idmap key type stores its payload length in key->datalen, which\nis limited to U16_MAX.  Accepting a larger key payload truncates the\nrecorded length and can make later users interpret the payload using\ninconsistent bounds.\n\nReject oversized preparsed payloads before allocating or copying them.\nThis keeps key->datalen consistent with the stored data for both inline\nand separately allocated idmap payloads.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93785","source_modified_at":"2026-10-03T10:57:20.267Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Linux","vendor":"Linux","versions":[{"version":"21fed0d5b763b94a7d1568c27d0cce892ab8d43e","lessThan":"eeac976b74b4f697cfc517187b7cbfd72652dbbc","status":"affected","versionType":"git"},{"version":"21fed0d5b763b94a7d1568c27d0cce892ab8d43e","lessThan":"125b05ac8ca8758950e4369c1542d57a162f504c","status":"affected","versionType":"git"},{"version":"21fed0d5b763b94a7d1568c27d0cce892ab8d43e","lessThan":"945f6cde6bcf8f08f6fa5df8882b1b9582e55efa","status":"affected","versionType":"git"},{"version":"21fed0d5b763b94a7d1568c27d0cce892ab8d43e","lessThan":"3a4a34a732e8a08309eed0a74314dbd9f2f1c972","status":"affected","versionType":"git"},{"version":"21fed0d5b763b94a7d1568c27d0cce892ab8d43e","lessThan":"6cfeef221ac00d63c07f6122f58e6159bde69ca0","status":"affected","versionType":"git"},{"version":"21fed0d5b763b94a7d1568c27d0cce892ab8d43e","lessThan":"8b12f65d7caf16d124098cb4895a203367d35b57","status":"affected","versionType":"git"},{"version":"21fed0d5b763b94a7d1568c27d0cce892ab8d43e","lessThan":"455488cd5054bcc59db40fa1cc2c004031a5b2a5","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93785","source_modified_at":"2026-10-03T10:57:20.267Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Linux","vendor":"Linux","versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","status":"unaffected","versionType":"semver"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93785","source_modified_at":"2026-10-03T10:57:20.267Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"125b05ac8ca8758950e4369c1542d57a162f504c","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93785","source_modified_at":"2026-10-03T10:57:20.267Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"945f6cde6bcf8f08f6fa5df8882b1b9582e55efa","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93785","source_modified_at":"2026-10-03T10:57:20.267Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"3a4a34a732e8a08309eed0a74314dbd9f2f1c972","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93785","source_modified_at":"2026-10-03T10:57:20.267Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"6cfeef221ac00d63c07f6122f58e6159bde69ca0","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93785","source_modified_at":"2026-10-03T10:57:20.267Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"8b12f65d7caf16d124098cb4895a203367d35b57","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93785","source_modified_at":"2026-10-03T10:57:20.267Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"455488cd5054bcc59db40fa1cc2c004031a5b2a5","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":0.00173,"percentile":0.0636,"score_date":"2026-10-23"},"published_at":"2026-09-24T16:02:18.964Z","modified_at":"2026-10-03T10:57:20.267Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-93785","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-03T10:57:20.267Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93785","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/eeac976b74b4f697cfc517187b7cbfd72652dbbc"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/125b05ac8ca8758950e4369c1542d57a162f504c"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/945f6cde6bcf8f08f6fa5df8882b1b9582e55efa"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/3a4a34a732e8a08309eed0a74314dbd9f2f1c972"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/6cfeef221ac00d63c07f6122f58e6159bde69ca0"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/8b12f65d7caf16d124098cb4895a203367d35b57"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/455488cd5054bcc59db40fa1cc2c004031a5b2a5"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-03T10:57:20.267Z","content_hash":"a6f29bd3723c50790b94d14579424cabe20d0d54f4ef8f88d5433047d3c1e24c"}}