https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 23:47:41 +0000 https://vulnerability.circl.lu/vuln/cve-2026-97564 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>smb: client: reject userspace cifs.idmap descriptions</p> <p>cifs.idmap key descriptions carry authority-bearing fields (owner and group SIDs and uid/gid values in &#34;os:&#34;/&#34;gs:&#34;/&#34;oi:&#34;/&#34;gi:&#34; form) that the cifs.idmap upcall helper treats as kernel-originating inputs. Unlike its sibling cifs.spnego, the cifs.idmap key type has no vet_description hook, so userspace can create keys of this type through request_key(2)/add_key(2) and supply those fields without CIFS origin. A request_key(2) call with a non-NULL callout then drives a root usermodehelper upcall (/sbin/request-key -&gt; cifs.idmap) that consumes the unvetted description in root context.</p> <p>Only accept cifs.idmap descriptions while CIFS is using its private root_cred to request the key. id_to_sid()/sid_to_id() already run under override_creds(root_cred), so the kernel-originated path is unaffected.</p> <p>This mirrors commit 3da1fdf4efbc (&#34;smb: client: reject userspace cifs.spnego descriptions&#34;), which applied the same restriction to cifs.spnego.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>smb: client: reject userspace cifs.idmap descriptions</p> <p>cifs.idmap key descriptions carry authority-bearing fields (owner and group SIDs and uid/gid values in &#34;os:&#34;/&#34;gs:&#34;/&#34;oi:&#34;/&#34;gi:&#34; form) that the cifs.idmap upcall helper treats as kernel-originating inputs. Unlike its sibling cifs.spnego, the cifs.idmap key type has no vet_description hook, so userspace can create keys of this type through request_key(2)/add_key(2) and supply those fields without CIFS origin. A request_key(2) call with a non-NULL callout then drives a root usermodehelper upcall (/sbin/request-key -&gt; cifs.idmap) that consumes the unvetted description in root context.</p> <p>Only accept cifs.idmap descriptions while CIFS is using its private root_cred to request the key. id_to_sid()/sid_to_id() already run under override_creds(root_cred), so the kernel-originated path is unaffected.</p> <p>This mirrors commit 3da1fdf4efbc (&#34;smb: client: reject userspace cifs.spnego descriptions&#34;), which applied the same restriction to cifs.spnego.</p> https://vulnerability.circl.lu/vuln/cve-2026-97564