{"schema":"threatline.record/2","record":{"id":"CVE-2026-97564","aliases":[],"summary":"smb: client: reject userspace cifs.idmap descriptions","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject userspace cifs.idmap descriptions\n\ncifs.idmap key descriptions carry authority-bearing fields (owner and\ngroup SIDs and uid/gid values in \"os:\"/\"gs:\"/\"oi:\"/\"gi:\" form) that the\ncifs.idmap upcall helper treats as kernel-originating inputs.  Unlike\nits sibling cifs.spnego, the cifs.idmap key type has no vet_description\nhook, so userspace can create keys of this type through\nrequest_key(2)/add_key(2) and supply those fields without CIFS origin.\nA request_key(2) call with a non-NULL callout then drives a root\nusermodehelper upcall (/sbin/request-key -> cifs.idmap) that consumes\nthe unvetted description in root context.\n\nOnly accept cifs.idmap descriptions while CIFS is using its private\nroot_cred to request the key.  id_to_sid()/sid_to_id() already run\nunder override_creds(root_cred), so the kernel-originated path is\nunaffected.\n\nThis mirrors commit 3da1fdf4efbc (\"smb: client: reject userspace\ncifs.spnego descriptions\"), which applied the same restriction to\ncifs.spnego.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97564","source_modified_at":"2026-10-19T09:09:27.178Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"4d79dba0e00749fa40de8ef13a9b85ce57a1603b","lessThan":"f29c1ec0e7d8c887a91df3f93bb4617c0ac95c6a","status":"affected","versionType":"git"},{"version":"4d79dba0e00749fa40de8ef13a9b85ce57a1603b","lessThan":"17c93bcd17755523c21abb22cbf2a41a6eb0caaf","status":"affected","versionType":"git"},{"version":"4d79dba0e00749fa40de8ef13a9b85ce57a1603b","lessThan":"e5964064e3fbe6325893408faff08ca33de0e2c3","status":"affected","versionType":"git"},{"version":"4d79dba0e00749fa40de8ef13a9b85ce57a1603b","lessThan":"96751028c0d4dec785709ea3eb0ab38a4f2ded96","status":"affected","versionType":"git"},{"version":"4d79dba0e00749fa40de8ef13a9b85ce57a1603b","lessThan":"1d3b24b16a0b013792e8f1e3ed060f0b46f537d1","status":"affected","versionType":"git"},{"version":"4d79dba0e00749fa40de8ef13a9b85ce57a1603b","lessThan":"d9d7eeb0cea5b55b82888f443622fd8d4ee064f3","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97564","source_modified_at":"2026-10-19T09:09:27.178Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"3.0","status":"affected"},{"version":"0","lessThan":"3.0","status":"unaffected","versionType":"semver"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97564","source_modified_at":"2026-10-19T09:09:27.178Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"17c93bcd17755523c21abb22cbf2a41a6eb0caaf","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97564","source_modified_at":"2026-10-19T09:09:27.178Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"96751028c0d4dec785709ea3eb0ab38a4f2ded96","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97564","source_modified_at":"2026-10-19T09:09:27.178Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"1d3b24b16a0b013792e8f1e3ed060f0b46f537d1","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":0.00205,"percentile":0.1003,"score_date":"2026-10-23"},"published_at":"2026-09-25T10:21:51.858Z","modified_at":"2026-10-19T09:09:27.178Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-97564","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T09:09:27.178Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97564","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/f29c1ec0e7d8c887a91df3f93bb4617c0ac95c6a"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/17c93bcd17755523c21abb22cbf2a41a6eb0caaf"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/e5964064e3fbe6325893408faff08ca33de0e2c3"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/96751028c0d4dec785709ea3eb0ab38a4f2ded96"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/1d3b24b16a0b013792e8f1e3ed060f0b46f537d1"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/d9d7eeb0cea5b55b82888f443622fd8d4ee064f3"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T09:09:27.178Z","content_hash":"00293201ab9c97776d43bdc366019729804b5f0c66838d2ccaf49637f6b7cd29"}}