An unprivileged user can create a cifs.idmap key with arbitrary authority data that the kernel treats as originating from the CIFS subsystem. The request triggers a root usermodehelper that processes the unvalidated description in a root context. The malicious description contains owner and group SIDs and uid/gid values that the kernel later translates into actual identities, enabling the attacker to manipulate user‑to‑SID mapping and gain elevated privileges.

The flaw is present in the Linux kernel across all distributions using the legacy cifs.idmap key type. No specific version range is enumerated in the CVE, so any unpatched kernel that implements cifs.idmap without the new restriction can be impacted.

Because the exploit runs a root‑level usermodehelper that interprets unchecked input, it can lead to privilege escalation. The CVSS score is 7.0, indicating high severity, and the EPSS score is less than 1%, implying a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalogue. An attacker who can request a key with request_key(2) can map arbitrary SIDs, potentially elevating themselves to root or another privileged identity. Local exploitation is required, with only user‑space write permissions to request a key as a prerequisite.