Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-93785

cifs: validate idmap key payload length

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, and 1 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: cifs: validate idmap key payload length The cifs.idmap key type stores its payload length in key->datalen, which is limited to U16_MAX. Accepting a larger key payload truncates the recorded length and can make later users interpret the payload using inconsistent bounds. Reject oversized preparsed payloads before allocating or copying them. This keeps key->datalen consistent with the stored data for both inline and separately allocated idmap payloads.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 21fed0d5b763b94a7d1568c27d0cce892ab8d43e · fixed in eeac976b74b4f697cfc517187b7cbfd72652dbbc; From 21fed0d5b763b94a7d1568c27d0cce892ab8d43e · fixed in 125b05ac8ca8758950e4369c1542d57a162f504c; From 21fed0d5b763b94a7d1568c27d0cce892ab8d43e · fixed in 945f6cde6bcf8f08f6fa5df8882b1b9582e55efa; From 21fed0d5b763b94a7d1568c27d0cce892ab8d43e · fixed in 3a4a34a732e8a08309eed0a74314dbd9f2f1c972; From 21fed0d5b763b94a7d1568c27d0cce892ab8d43e · fixed in 6cfeef221ac00d63c07f6122f58e6159bde69ca0; From 21fed0d5b763b94a7d1568c27d0cce892ab8d43e · fixed in 8b12f65d7caf16d124098cb4895a203367d35b57; From 21fed0d5b763b94a7d1568c27d0cce892ab8d43e · fixed in 455488cd5054bcc59db40fa1cc2c004031a5b2a5

  • Linux Linux

    3.2

  • KernelLinux

    From 3.2.0 · fixed in 5.10.271; From 5.11.0 · fixed in 5.15.222; From 5.16.0 · fixed in 6.1.189; From 6.2.0 · fixed in 6.6.158; From 6.7.0 · fixed in 6.12.111; From 6.13.0 · fixed in 6.18.53

References 7

git.kernel.org