The Linux kernel’s CIFS implementation records the data length of an idmap key in the key->datalen field, which is capped at the 16‑bit maximum. When a larger payload is supplied, the system truncates the recorded length while still accepting the full data, causing later components to interpret the payload with mismatched bounds. The mismatch can lead to unpredictable behavior when the key is later used.

All Linux kernel installations exposing the CIFS idmap key type are affected; the issue is present in any kernel build that uses the cifs module, regardless of distribution. Specific kernel version ranges are not listed in the advisory.

If an attacker can provide CIFS idmap keys with oversized payloads, the kernel may record incorrect lengths, leading to mismatched bounds in subsequent operations. The CVSS score of 5.5 indicates moderate severity, while the EPSS score of <1% suggests a low likelihood of exploitation. This vulnerability is not listed in CISA KEV, so there is no known active exploitation at this time.