CVE-2026-97564
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions cifs.idmap key descriptions carry authority-bearing fields (owner and group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form) that the cifs.idmap upcall helper treats as kernel-originating inputs. Unlike its sibling cifs.spnego, the cifs.idmap key type has no vet_description hook, so userspace can create keys of this type through request_key(2)/add_key(2) and supply those fields without CIFS origin. A request_key(2) call with a non-NULL callout then drives a root usermodehelper upcall (/sbin/request-key -> cifs.idmap) that consumes the unvetted description in root context. Only accept cifs.idmap descriptions while CIFS is using its private root_cred to request the key. id_to_sid()/sid_to_id() already run under override_creds(root_cred), so the kernel-originated path is unaffected. This mirrors commit 3da1fdf4efbc ("smb: client: reject userspace cifs.spnego descriptions"), which applied the same restriction to cifs.spnego.
Severity
Not scored
CVSS score
Not available
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-09-25 11:17:07.007000
Last modified
2026-10-30 13:21:08.353000
View original CVE JSON
{
"id": "CVE-2026-97564",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-09-25T11:17:07.007",
"lastModified": "2026-10-30T13:21:08.353",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject userspace cifs.idmap descriptions\n\ncifs.idmap key descriptions carry authority-bearing fields (owner and\ngroup SIDs and uid/gid values in \"os:\"/\"gs:\"/\"oi:\"/\"gi:\" form) that the\ncifs.idmap upcall helper treats as kernel-originating inputs. Unlike\nits sibling cifs.spnego, the cifs.idmap key type has no vet_description\nhook, so userspace can create keys of this type through\nrequest_key(2)/add_key(2) and supply those fields without CIFS origin.\nA request_key(2) call with a non-NULL callout then drives a root\nusermodehelper upcall (/sbin/request-key -> cifs.idmap) that consumes\nthe unvetted description in root context.\n\nOnly accept cifs.idmap descriptions while CIFS is using its private\nroot_cred to request the key. id_to_sid()/sid_to_id() already run\nunder override_creds(root_cred), so the kernel-originated path is\nunaffected.\n\nThis mirrors commit 3da1fdf4efbc (\"smb: client: reject userspace\ncifs.spnego descriptions\"), which applied the same restriction to\ncifs.spnego."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"fs/smb/client/cifsacl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4d79dba0e00749fa40de8ef13a9b85ce57a1603b",
"lessThan": "91da70a2e5c6f54e1316d51e0e6911e78ef5e09a",
"versionType": "git",
"status": "affected"
},
{
"version": "4d79dba0e00749fa40de8ef13a9b85ce57a1603b",
"lessThan": "856cb3f05b49d23dc1542f78696e20c4ea6dd7de",
"versionType": "git",
"status": "affected"
},
{
"version": "4d79dba0e00749fa40de8ef13a9b85ce57a1603b",
"lessThan": "f29c1ec0e7d8c887a91df3f93bb4617c0ac95c6a",
"versionType": "git",
"status": "affected"
},
{
"version": "4d79dba0e00749fa40de8ef13a9b85ce57a1603b",
"lessThan": "17c93bcd17755523c21abb22cbf2a41a6eb0caaf",
"versionType": "git",
"status": "affected"
},
{
"version": "4d79dba0e00749fa40de8ef13a9b85ce57a1603b",
"lessThan": "e5964064e3fbe6325893408faff08ca33de0e2c3",
"versionType": "git",
"status": "affected"
},
{
"version": "4d79dba0e00749fa40de8ef13a9b85ce57a1603b",
"lessThan": "96751028c0d4dec785709ea3eb0ab38a4f2ded96",
"versionType": "git",
"status": "affected"
},
{
"version": "4d79dba0e00749fa40de8ef13a9b85ce57a1603b",
"lessThan": "1d3b24b16a0b013792e8f1e3ed060f0b46f537d1",
"versionType": "git",
"status": "affected"
},
{
"version": "4d79dba0e00749fa40de8ef13a9b85ce57a1603b",
"lessThan": "d9d7eeb0cea5b55b82888f443622fd8d4ee064f3",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"fs/smb/client/cifsacl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "3.0",
"status": "affected"
},
{
"version": "0",
"lessThan": "3.0",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.273",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.224",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.189",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.158",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.111",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.53",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.7",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/17c93bcd17755523c21abb22cbf2a41a6eb0caaf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1d3b24b16a0b013792e8f1e3ed060f0b46f537d1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/856cb3f05b49d23dc1542f78696e20c4ea6dd7de",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/91da70a2e5c6f54e1316d51e0e6911e78ef5e09a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/96751028c0d4dec785709ea3eb0ab38a4f2ded96",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d9d7eeb0cea5b55b82888f443622fd8d4ee064f3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e5964064e3fbe6325893408faff08ca33de0e2c3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f29c1ec0e7d8c887a91df3f93bb4617c0ac95c6a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}