CVE-2026-97564

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject userspace cifs.idmap descriptions

cifs.idmap key descriptions carry authority-bearing fields (owner and

group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form) that the

cifs.idmap upcall helper treats as kernel-originating inputs. Unlike

its sibling cifs.spnego, the cifs.idmap key type has no vet_description

hook, so userspace can create keys of this type through

request_key(2)/add_key(2) and supply those fields without CIFS origin.

A request_key(2) call with a non-NULL callout then drives a root

usermodehelper upcall (/sbin/request-key -> cifs.idmap) that consumes

the unvetted description in root context.

Only accept cifs.idmap descriptions while CIFS is using its private

root_cred to request the key. id_to_sid()/sid_to_id() already run

under override_creds(root_cred), so the kernel-originated path is

unaffected.

This mirrors commit 3da1fdf4efbc ("smb: client: reject userspace

cifs.spnego descriptions"), which applied the same restriction to

cifs.spnego.