HIGH Introduced in 3.0
smb Idmap Key Bypass
CVE-2026-97564
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
01Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions cifs.idmap key descriptions carry authority-bearing fields (owner and group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form) that the cifs.idmap upcall helper treats as kernel-originating inputs. Unlike its sibling cifs.spnego, the cifs.idmap key type has no vet_description hook, so userspace can create keys of this type through request_key(2)/add_key(2) and supply those fields without CIFS origin. A request_key(2) call with a non-NULL callout then drives a root usermodehelper upcall (/sbin/request-key -> cifs.idmap) that consumes the unvetted description in root context. Only accept cifs.idmap descriptions while CIFS is using its private root_cred to request the key. id_to_sid()/sid_to_id() already run under override_creds(root_cred), so the kernel-originated path is unaffected. This mirrors commit 3da1fdf4efbc ("smb: client: reject userspace cifs.spnego descriptions"), which applied the same restriction to cifs.spnego.
02KernelScan AI Analysis
Risk summary
An unprivileged local user can create cifs.idmap keyring keys with authority-bearing SID and uid/gid fields that are normally only supplied by the kernel. These fields are consumed by a root usermodehelper upcall, allowing the attacker to manipulate id mappings processed in root context and potentially gain unauthorized access to data. Any system with the CIFS module loaded and local user access is affected.
Vulnerability analysis
The CIFS client’s idmap key type allowed any local user to create keys carrying authority-bearing fields such as owner and group SIDs and uid or gid values. These descriptions were treated as trusted kernel input by a root usermodehelper upcall, so an attacker could supply arbitrary mappings to be processed with root privileges. The fix restricts creation of these keys to the kernel’s internal CIFS credential, blocking userspace from injecting descriptions. Any local user on a system with the CIFS module loaded can reach the vulnerable path through the keyring syscalls.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 3.0 | 6.1.189 | f29c1ec0e7d8 |
| 6.6 | 3.0 | 6.6.158 | 17c93bcd1775 |
| 6.12 | 3.0 | 6.12.111 | e5964064e3fb |
| 6.18 | 3.0 | 6.18.53 | 96751028c0d4 |
| 7.2 | 3.0 | 7.2.7 | 1d3b24b16a0b |
| mainline | 3.0 | 7.3-rc3 | d9d7eeb0cea5 |
| cip/6.12 | 3.0 | 6.12.111-cip32 | e5964064e3fb |