8.5

CVE-2026-97564: linux

CVSS: 8.5v4.0HighReceived
AliasesUBUNTU-CVE-2026-97564DEBIAN-CVE-2026-97564
Published 25-09-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-97564 is a high (CVSS 8.5) vulnerability in linux. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10% of scored vulnerabilities.

Overall risk
34/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.5/10
010
High · v4.0 (OSV · Ubuntu), selected by version preference
EPSS score
0.21%
0%100%
Low · Change unavailable
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2026:12074-1

Timeline

  1. 25-09-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions cifs.idmap key descriptions carry authority-bearing fields (owner and group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form) that the cifs.idmap upcall helper treats as kernel-originating inputs. Unlike its sibling cifs.spnego, the cifs.idmap key type has no vet_description hook, so userspace can create keys of this type through request_key(2)/add_key(2) and supply those fields without CIFS origin. A request_key(2) call with a non-NULL callout then drives a root usermodehelper upcall (/sbin/request-key -> cifs.idmap) that consumes the unvetted description in root context. Only accept cifs.idmap descriptions while CIFS is using its private root_cred to request the key. id_to_sid()/sid_to_id() already run under override_creds(root_cred), so the kernel-originated path is unaffected. This mirrors commit 3da1fdf4efbc ("smb: client: reject userspace cifs.spnego descriptions"), which applied the same restriction to cifs.spnego.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

0.21%

Chance of exploitation in the next 30 days

Percentile

10%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

26-09-202621-10-2026
EPSS score
0.21%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu169 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linuxAll versions (No fix recorded) | < 6.1.190-1 | < 6.12.111-1 | < 7.2.7-1
  • linux-6.12< 6.12.111-1~deb12u1
Linux1 product
  • linux≥ 4d79dba0e00749fa40de8ef13a9b85ce57a1603b, < f29c1ec0e7d8c887a91df3f93bb4617c0ac95c6a | ≥ 4d79dba0e00749fa40de8ef13a9b85ce57a1603b, < 17c93bcd17755523c21abb22cbf2a41a6eb0caaf | ≥ 4d79dba0e00749fa40de8ef13a9b85ce57a1603b, < e5964064e3fbe6325893408faff08ca33de0e2c3 | ≥ 4d79dba0e00749fa40de8ef13a9b85ce57a1603b, < 96751028c0d4dec785709ea3eb0ab38a4f2ded96 | ≥ 4d79dba0e00749fa40de8ef13a9b85ce57a1603b, < 1d3b24b16a0b013792e8f1e3ed060f0b46f537d1 | ≥ 4d79dba0e00749fa40de8ef13a9b85ce57a1603b, < d9d7eeb0cea5b55b82888f443622fd8d4ee064f3 | 3.0

3 vendors · 172 products

References

9 links