CVE-2026-97564

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject userspace cifs.idmap descriptions

cifs.idmap key descriptions carry authority-bearing fields (owner and

group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form) that the

cifs.idmap upcall helper treats as kernel-originating inputs. Unlike

its sibling cifs.spnego, the cifs.idmap key type has no vet_description

hook, so userspace can create keys of this type through

request_key(2)/add_key(2) and supply those fields without CIFS origin.

A request_key(2) call with a non-NULL callout then drives a root

usermodehelper upcall (/sbin/request-key -> cifs.idmap) that consumes

the unvetted description in root context.

Only accept cifs.idmap descriptions while CIFS is using its private

root_cred to request the key. id_to_sid()/sid_to_id() already run

under override_creds(root_cred), so the kernel-originated path is

unaffected.

This mirrors commit 3da1fdf4efbc ("smb: client: reject userspace

cifs.spn

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References