CVE-2026-93785 cifs: validate idmap key payload length
An attacker with local access can trigger an integer overflow in the CIFS idmap key handling, leading to inconsistent payload bounds and potential memory safety issues.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93785?
CVE-2026-93785 is a vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
cifs: validate idmap key payload length
The cifs.idmap key type stores its payload length in key->datalen, which is limited to U16_MAX. Accepting a larger key payload truncates the recorded length and can make later users interpret the payload using inconsistent bounds.
Reject oversized preparsed payloads before allocating or copying them. This keeps key->datalen consistent with the stored data for both inline and separately allocated idmap payloads.
Which versions are affected by CVE-2026-93785?
How do I fix CVE-2026-93785?
Apply the vendor's patch.
Is CVE-2026-93785 being exploited?
There is no known exploitation of CVE-2026-93785 in the wild and no public exploit code.
Sources
Also known as AZL-103994, BELL-CVE-2026-93785, DEBIAN-CVE-2026-93785, GHSA-qvvf-f4g9-5p95, UBUNTU-CVE-2026-93785.