CVE-2026-97564

smb: client: reject userspace cifs.idmap descriptions

State: Published
Severity: Not scored
Published: Sep 25, 2026
Updated: Oct 30, 2026
Reserved: Sep 24, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject userspace cifs.idmap descriptions

cifs.idmap key descriptions carry authority-bearing fields (owner and group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form) that the cifs.idmap upcall helper treats as kernel-originating inputs. Unlike its sibling cifs.spnego, the cifs.idmap key type has no vet_description hook, so userspace can create keys of this type through request_key(2)/add_key(2) and supply those fields without CIFS origin. A request_key(2) call with a non-NULL callout then drives a root usermodehelper upcall (/sbin/request-key -> cifs.idmap) that consumes the unvetted description in root context.

Only accept cifs.idmap descriptions while CIFS is using its private root_cred to request the key. id_to_sid()/sid_to_id() already run under override_creds(root_cred), so the kernel-originated path is unaffected.

This mirrors commit 3da1fdf4efbc ("smb: client: reject userspace cifs.spnego descriptions"), which applied the same restriction to cifs.spnego.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4d79dba0e00749fa40de8ef13a9b85ce57a1603b to before 91da70a2e5c6f54e1316d51e0e6911e78ef5e09aAffected 4d79dba0e00749fa40de8ef13a9b85ce57a1603b to before 856cb3f05b49d23dc1542f78696e20c4ea6dd7deAffected 4d79dba0e00749fa40de8ef13a9b85ce57a1603b to before f29c1ec0e7d8c887a91df3f93bb4617c0ac95c6aAffected 4d79dba0e00749fa40de8ef13a9b85ce57a1603b to before 17c93bcd17755523c21abb22cbf2a41a6eb0caafAffected 4d79dba0e00749fa40de8ef13a9b85ce57a1603b to before e5964064e3fbe6325893408faff08ca33de0e2c3Affected 4d79dba0e00749fa40de8ef13a9b85ce57a1603b to before 96751028c0d4dec785709ea3eb0ab38a4f2ded96Affected 4d79dba0e00749fa40de8ef13a9b85ce57a1603b to before 1d3b24b16a0b013792e8f1e3ed060f0b46f537d1Affected 4d79dba0e00749fa40de8ef13a9b85ce57a1603b to before d9d7eeb0cea5b55b82888f443622fd8d4ee064f3Affected
LinuxLinux	3.0Affected before 3.0Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.7 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

4d79dba0e00749fa40de8ef13a9b85ce57a1603b to before 91da70a2e5c6f54e1316d51e0e6911e78ef5e09aAffected
4d79dba0e00749fa40de8ef13a9b85ce57a1603b to before 856cb3f05b49d23dc1542f78696e20c4ea6dd7deAffected
4d79dba0e00749fa40de8ef13a9b85ce57a1603b to before f29c1ec0e7d8c887a91df3f93bb4617c0ac95c6aAffected
4d79dba0e00749fa40de8ef13a9b85ce57a1603b to before 17c93bcd17755523c21abb22cbf2a41a6eb0caafAffected
4d79dba0e00749fa40de8ef13a9b85ce57a1603b to before e5964064e3fbe6325893408faff08ca33de0e2c3Affected
4d79dba0e00749fa40de8ef13a9b85ce57a1603b to before 96751028c0d4dec785709ea3eb0ab38a4f2ded96Affected
4d79dba0e00749fa40de8ef13a9b85ce57a1603b to before 1d3b24b16a0b013792e8f1e3ed060f0b46f537d1Affected
4d79dba0e00749fa40de8ef13a9b85ce57a1603b to before d9d7eeb0cea5b55b82888f443622fd8d4ee064f3Affected

LinuxLinux

3.0Affected
before 3.0Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.