All vulnerabilities
CVE-2026-97564

Linux: smb: client: reject userspace cifs.idmap descriptions

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in17c93bcd17755523c21abb22cbf2a41a6eb0caafAlso 96751028c0d4dec785709ea3eb0ab38a4f2ded96, 1d3b24b16a0b013792e8f1e3ed060f0b46f537d1CVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 17c93bcd17755523c21abb22cbf2a41a6eb0caafLinuxCVE List
  • 96751028c0d4dec785709ea3eb0ab38a4f2ded96LinuxCVE List
  • 1d3b24b16a0b013792e8f1e3ed060f0b46f537d1LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject userspace cifs.idmap descriptions

cifs.idmap key descriptions carry authority-bearing fields (owner and group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form) that the cifs.idmap upcall helper treats as kernel-originating inputs. Unlike its sibling cifs.spnego, the cifs.idmap key type has no vet_description hook, so userspace can create keys of this type through request_key(2)/add_key(2) and supply those fields without CIFS origin. A request_key(2) call with a non-NULL callout then drives a root usermodehelper upcall (/sbin/request-key -> cifs.idmap) that consumes the unvetted description in root context.

Only accept cifs.idmap descriptions while CIFS is using its private root_cred to request the key. id_to_sid()/sid_to_id() already run under override_creds(root_cred), so the kernel-originated path is unaffected.

This mirrors commit 3da1fdf4efbc ("smb: client: reject userspace cifs.spnego descriptions"), which applied the same restriction to cifs.spnego.

Text from CVE List

Affected versions 14

  • Linuxaffected: 4d79dba0e00749fa40de8ef13a9b85ce57a1603b before f29c1ec0e7d8c887a91df3f93bb4617c0ac95c6aCVE List
  • Linuxaffected: 4d79dba0e00749fa40de8ef13a9b85ce57a1603b before 17c93bcd17755523c21abb22cbf2a41a6eb0caafCVE List
  • Linuxaffected: 4d79dba0e00749fa40de8ef13a9b85ce57a1603b before e5964064e3fbe6325893408faff08ca33de0e2c3CVE List
  • Linuxaffected: 4d79dba0e00749fa40de8ef13a9b85ce57a1603b before 96751028c0d4dec785709ea3eb0ab38a4f2ded96CVE List
  • Linuxaffected: 4d79dba0e00749fa40de8ef13a9b85ce57a1603b before 1d3b24b16a0b013792e8f1e3ed060f0b46f537d1CVE List
  • Linuxaffected: 4d79dba0e00749fa40de8ef13a9b85ce57a1603b before d9d7eeb0cea5b55b82888f443622fd8d4ee064f3CVE List
  • Linuxaffected: 3.0CVE List
  • Linuxunaffected: all versions before 3.0CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 6