CVE-2026-97564
Received Received - Intake

Linux Kernel SMB Client IDMAP Description Validation Bypass

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions cifs.idmap key descriptions carry authority-bearing fields (owner and group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form) that the cifs.idmap upcall helper treats as kernel-originating inputs. Unlike its sibling cifs.spnego, the cifs.idmap key type has no vet_description hook, so userspace can create keys of this type through request_key(2)/add_key(2) and supply those fields without CIFS origin. A request_key(2) call with a non-NULL callout then drives a root usermodehelper upcall (/sbin/request-key -> cifs.idmap) that consumes the unvetted description in root context. Only accept cifs.idmap descriptions while CIFS is using its private root_cred to request the key. id_to_sid()/sid_to_id() already run under override_creds(root_cred), so the kernel-originated path is unaffected. This mirrors commit 3da1fdf4efbc ("smb: client: reject userspace cifs.spnego descriptions"), which applied the same restriction to cifs.spnego.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97564
EUVD
EUVD-2026-86872

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel to 3.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves the cifs.idmap component, which handles identity mapping for SMB/CIFS protocol. The issue is that userspace can create keys with authority-bearing fields (like SIDs or uid/gid values) through request_key(2)/add_key(2) calls. These keys are then processed by the cifs.idmap upcall helper without proper validation, allowing privilege escalation since the helper runs in root context via usermodehelper.

Impact Analysis

If exploited, this vulnerability could allow an attacker with local access to escalate privileges to root by crafting malicious cifs.idmap keys. This could lead to full system compromise, unauthorized data access, or further lateral movement within a network if the system is part of a larger infrastructure.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and data protection, such as GDPR (data integrity) or HIPAA (confidentiality). A successful exploit may lead to unauthorized access to sensitive data, resulting in regulatory penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this vulnerability. Monitor for unusual key creation or request_key calls related to cifs.idmap. Ensure the cifs.idmap upcall helper is not processing untrusted userspace inputs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97564. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart