cifs IdmapKey Overflow

Vulnerability analysis

The CIFS idmap key type stores its payload length in a field limited to 65535, but the key instantiation function accepted payloads larger than that limit without checking. When an oversized payload is supplied, the recorded length is silently truncated, leaving the stored data and its recorded size inconsistent; later code that reads the idmap key may then interpret the payload using the wrong bounds and access memory outside the intended region. The fix rejects any payload whose length exceeds the maximum representable value before any data is allocated or copied, keeping the recorded length consistent with the actual stored data. The vulnerability is reachable from a local unprivileged process through the standard keyring syscall interface whenever the CIFS module is present; no network access, special capabilities, or particular hardware are required.