CVE-2026-97564

The Linux kernel contains a vulnerability in the SMB client where the cifs.idmap key type lacks a vet_description hook. This allows userspace to create keys via request_key(2) or add_key(2) containing authority-bearing fields (such as SIDs and uid/gid values) that are improperly treated as kernel...

EUVD-2026-86872

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions cifs.idmap key descriptions carry authority-bearing fields owner and group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form that the cifs.idmap upcall helper treats as...

CVE-2026-97564

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions cifs.idmap key descriptions carry authority-bearing fields owner and group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form that the cifs.idmap upcall helper treats as...

CVE-2026-97555 smb: client: fix heap overflow in DACL owner/group rewrite

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When idmodetocifsacl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by daclptr-size. However, replacesidsandcopyaces...

CVE-2026-97555

A heap overflow vulnerability exists in the Linux kernel 's SMB client within the DACL owner/group rewrite process. When id_mode_to_cifs_acl rewrites an existing DACL, it incorrectly allocates a buffer based on the on-disk length. If the replacement SIDs obtained from the cifs.idmap upcall are lo...