CVE-2026-97564smb: client: reject userspace cifs.idmap descriptions
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions cifs.idmap key descriptions carry authority-bearing fields (owner and group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form) that the cifs.idmap upcall helper treats as kernel-originating inputs. Unlike its sibling cifs.spnego, the cifs.idmap key type has no vet_description hook, so userspace can create keys of this type through request_key(2)/add_key(2) and supply those fields without CIFS origin. A request_key(2) call with a non-NULL callout then drives a root usermodehelper upcall (/sbin/request-key -> cifs.idmap) that consumes the unvetted description in root context. Only accept cifs.idmap descriptions while CIFS is using its private root_cred to request the key. id_to_sid()/sid_to_id() already run under override_creds(root_cred), so the kernel-originated path is unaffected. This mirrors commit 3da1fdf4efbc ("smb: client: reject userspace cifs.spnego descriptions"), which applied the same restriction to cifs.spnego.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 4d79dba0e00749fa40de8ef13a9b85ce57a1603b before f29c1ec0e7d8c887a91df3f93bb4617c0ac95c6a; from 4d79dba0e00749fa40de8ef13a9b85ce57a1603b before 17c93bcd17755523c21abb22cbf2a41a6eb0caaf; from 4d79dba0e00749fa40de8ef13a9b85ce57a1603b before e5964064e3fbe6325893408faff08ca33de0e2c3; from 4d79dba0e00749fa40de8ef13a9b85ce57a1603b before 96751028c0d4dec785709ea3eb0ab38a4f2ded96; 4d79dba0e00749fa40de8ef13a9b85ce57a1603b builds before 1d3b24b16a0b013792e8f1e3ed060f0b46f537d1; from 4d79dba0e00749fa40de8ef13a9b85ce57a1603b before d9d7eeb0cea5b55b82888f443622fd8d4ee064f3 | CNA record |
References
- https://git.kernel.org/stable/c/f29c1ec0e7d8c887a91df3f93bb4617c0ac95c6a
- https://git.kernel.org/stable/c/17c93bcd17755523c21abb22cbf2a41a6eb0caaf
- https://git.kernel.org/stable/c/e5964064e3fbe6325893408faff08ca33de0e2c3
- https://git.kernel.org/stable/c/96751028c0d4dec785709ea3eb0ab38a4f2ded96
- https://git.kernel.org/stable/c/1d3b24b16a0b013792e8f1e3ed060f0b46f537d1
- https://git.kernel.org/stable/c/d9d7eeb0cea5b55b82888f443622fd8d4ee064f3
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.