CVE-2026-97564 smb: client: reject userspace cifs.idmap descriptions
Local attackers can exploit missing validation in the Linux kernel SMB client to trigger a root-context upcall, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97564?
CVE-2026-97564 is a vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: reject userspace cifs.idmap descriptions
cifs.idmap key descriptions carry authority-bearing fields (owner and group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form) that the cifs.idmap upcall helper treats as kernel-originating inputs. Unlike its sibling cifs.spnego, the cifs.idmap key type has no vet_description hook, so userspace can create keys of this type through request_key(2)/add_key(2) and supply those fields without CIFS origin. A request_key(2) call with a non-NULL callout then drives a root usermodehelper upcall (/sbin/request-key -> cifs.idmap) that consumes the unvetted description in root context.
Only accept cifs.idmap descriptions while CIFS is using its private root_cred to request the key. id_to_sid()/sid_to_id() already run under override_creds(root_cred), so the kernel-originated path is unaffected.
This mirrors commit 3da1fdf4efbc ("smb: client: reject userspace cifs.spnego descriptions"), which applied the same restriction to cifs.spnego.
Which versions are affected by CVE-2026-97564?
How do I fix CVE-2026-97564?
Apply the vendor's patch.
Is CVE-2026-97564 being exploited?
There is no known exploitation of CVE-2026-97564 in the wild and no public exploit code.
Sources
Also known as AZL-104379, BELL-CVE-2026-97564, DEBIAN-CVE-2026-97564, GHSA-3fc8-28wq-wq67, UBUNTU-CVE-2026-97564.