Asim Viladi Oglu Manizada 3da1fdf4ef smb: client: reject userspace cifs.spnego descriptions ...

cifs.spnego key descriptions contain authority-bearing fields such as
pid, uid, creduid, and upcall_target that cifs.upcall treats as
kernel-originating inputs. However, userspace can also create keys of
this type through request_key(2) or add_key(2), allowing those fields to
be supplied without CIFS origin.

Only accept cifs.spnego descriptions while CIFS is using its private
spnego_cred to request the key.

Fixes: f1d662a7d5 ("[CIFS] Add upcall files for cifs to use spnego/kerberos")
Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
Signed-off-by: Steve French <stfrench@microsoft.com>

2026-05-19 10:43:05 -05:00

..

9p

Merge tag '9p-for-7.1-rc1' of https://github.com/martinetd/linux

2026-04-24 13:37:26 -07:00

adfs

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux

2026-04-25 07:44:26 -07:00

affs

Merge tag 'pull-dcache-busy-wait' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2026-04-21 07:30:44 -07:00

afs

Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-04-15 12:59:16 -07:00

autofs

Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 14:20:11 -07:00

befs

treewide: change inode->i_ino from unsigned long to u64

2026-03-06 14:31:28 +01:00

bfs

Merge tag 'vfs-7.1-rc1.bh.metadata' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 12:46:42 -07:00

btrfs

Merge tag 'for-7.1-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux

2026-05-15 13:22:07 -07:00

cachefiles

Merge tag 'vfs-7.1-rc1.kino' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 12:19:01 -07:00

ceph

ceph: put folios not suitable for writeback

2026-05-11 10:39:22 +02:00

coda

Merge tag 'pull-coda' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2026-04-21 14:03:10 -07:00

configfs

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

cramfs

treewide: change inode->i_ino from unsigned long to u64

2026-03-06 14:31:28 +01:00

crypto

Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux

2026-04-13 17:29:12 -07:00

debugfs

debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str()

2026-04-02 16:15:23 +02:00

devpts

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

dlm

ipv6: convert CONFIG_IPV6 to built-in only and clean up Kconfigs

2026-03-29 11:21:22 -07:00

ecryptfs

Merge tag 'ecryptfs-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs

2026-04-20 10:54:17 -07:00

efivarfs

efivarfs: use QSTR() in efivarfs_alloc_dentry

2026-04-28 12:30:59 +02:00

efs

treewide: change inode->i_ino from unsigned long to u64

2026-03-06 14:31:28 +01:00

erofs

Merge tag 'erofs-for-7.1-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs

2026-04-21 11:16:04 -07:00

exfat

Merge tag 'exfat-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat

2026-04-13 16:57:31 -07:00

exportfs

Merge tag 'pull-dcache-busy-wait' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2026-04-21 07:30:44 -07:00

ext2

Merge tag 'fs_for_v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs

2026-04-15 19:22:16 -07:00

ext4

Merge tag 'ext4_for_linux-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4

2026-04-17 17:08:31 -07:00

f2fs

Merge tag 'f2fs-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs

2026-04-21 14:50:04 -07:00

fat

Merge tag 'vfs-7.1-rc1.bh.metadata' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 12:46:42 -07:00

freevxfs

treewide: change inode->i_ino from unsigned long to u64

2026-03-06 14:31:28 +01:00

fuse

Merge tag 'vfs-7.1-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-23 17:08:04 -07:00

gfs2

Merge tag 'gfs2-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2

2026-04-15 19:12:04 -07:00

hfs

Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 14:20:11 -07:00

hfsplus

Merge tag 'hfs-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs

2026-04-13 16:50:38 -07:00

hostfs

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hpfs

treewide: change inode->i_ino from unsigned long to u64

2026-03-06 14:31:28 +01:00

hugetlbfs

Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-04-15 12:59:16 -07:00

iomap

block: pass a minsize argument to bio_iov_iter_bounce

2026-05-13 13:55:06 -06:00

isofs

isofs: use QSTR_LEN() in isofs_cmp

2026-04-20 17:27:28 +02:00

jbd2

Merge tag 'ext4_for_linux-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4

2026-04-17 17:08:31 -07:00

jffs2

treewide: change inode->i_ino from unsigned long to u64

2026-03-06 14:31:28 +01:00

jfs

Merge tag 'jfs-7.1' of github.com:kleikamp/linux-shaggy

2026-04-15 19:29:18 -07:00

kernfs

Merge tag 'driver-core-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core

2026-04-13 19:03:11 -07:00

lockd

Merge tag 'nfsd-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux

2026-04-20 10:44:02 -07:00

minix

Merge tag 'vfs-7.1-rc1.bh.metadata' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 12:46:42 -07:00

netfs

Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-04-15 12:59:16 -07:00

nfs

Merge tag 'nfs-for-7.1-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs

2026-04-24 14:20:03 -07:00

nfs_common

NFSD: Remove NFSERR_EAGAIN

2026-01-02 13:43:41 -05:00

nfsd

Merge tag 'nfsd-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux

2026-05-15 13:11:41 -07:00

nilfs2

Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-04-15 12:59:16 -07:00

nls

fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8()

2025-12-01 11:58:06 +02:00

notify

Merge tag 'fsnotify_for_v7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs

2026-04-27 16:40:24 -07:00

ntfs

ntfs: Use return instead of goto in ntfs_mapping_pairs_decompress()

2026-04-30 07:05:48 +09:00

ntfs3

Merge tag 'ntfs3_for_7.1' of https://github.com/Paragon-Software-Group/linux-ntfs3

2026-04-20 10:59:47 -07:00

ocfs2

Merge tag 'pull-dcache-busy-wait' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2026-04-21 07:30:44 -07:00

omfs

Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 14:20:11 -07:00

openpromfs

Coccinelle-based conversion to use ->i_state accessors

2025-10-20 20:22:26 +02:00

orangefs

Merge tag 'for-linus-7.1-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux

2026-04-17 17:03:43 -07:00

overlayfs

ovl: fix verity lazy-load guard broken by fsverity_active() semantic change

2026-05-06 08:37:30 -07:00

proc

Merge tag 'mm-nonmm-stable-2026-04-15-04-20' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-04-16 20:11:56 -07:00

pstore

Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-04-15 12:59:16 -07:00

qnx4

Merge tag 'vfs-7.1-rc1.bh.metadata' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 12:46:42 -07:00

qnx6

Merge tag 'vfs-7.1-rc1.bh.metadata' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 12:46:42 -07:00

quota

quota: Fix race of dquot_scan_active() with quota deactivation

2026-03-25 13:15:36 +01:00

ramfs

folio_batch: rename pagevec.h to folio_batch.h

2026-04-05 13:53:07 -07:00

resctrl

Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-04-15 12:59:16 -07:00

romfs

Merge tag 'mm-stable-2026-02-18-19-48' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-02-18 20:50:32 -08:00

smb

smb: client: reject userspace cifs.spnego descriptions

2026-05-19 10:43:05 -05:00

squashfs

Squashfs: check metadata block offset is within range

2026-02-24 11:13:27 -08:00

sysfs

Merge tag 'driver-core-7.1-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core

2026-04-19 12:58:08 -07:00

tests

fs/tests: exec: Remove bad test vector

2026-03-18 11:41:53 -07:00

tracefs

Merge tag 'tracefs-v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

2026-04-22 15:09:01 -07:00

ubifs

Merge tag 'mm-nonmm-stable-2026-04-15-04-20' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-04-16 20:11:56 -07:00

udf

udf: reject descriptors with oversized CRC length

2026-04-22 17:14:48 +02:00

ufs

Merge tag 'vfs-7.1-rc1.bh.metadata' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 12:46:42 -07:00

unicode

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

vboxsf

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

verity

Merge tag 'vfs-7.1-rc1.kino' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 12:19:01 -07:00

xfs

xfs: Fix typo in comment

2026-05-11 12:58:38 +02:00

zonefs

Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-04-15 12:59:16 -07:00

aio.c

fs: aio: reject partial mremap to avoid Null-pointer-dereference error

2026-04-24 00:34:59 +02:00

anon_inodes.c

anon_inodes: convert to FD_ADD()

2025-11-28 12:42:31 +01:00

attr.c

fs: attr: fix comment formatting and spelling issues

2026-04-07 11:26:11 +02:00

backing-file.c

lsm: add backing_file LSM hooks

2026-04-03 16:53:50 -04:00

bad_inode.c

fs: refactor ->update_time handling

2026-01-12 14:01:32 +01:00

binfmt_elf_fdpic.c

Merge tag 'vfs-7.1-rc1.kino' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 12:19:01 -07:00

binfmt_elf.c

mm: unexport vm_brk_flags() and eliminate vm_flags parameter

2026-04-05 13:53:39 -07:00

binfmt_flat.c

…

binfmt_misc.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

binfmt_script.c

…

bpf_fs_kfuncs.c

bpf: Remove redundant KF_TRUSTED_ARGS flag from all kfuncs

2026-01-02 12:04:28 -08:00

buffer.c

Merge tag 'vfs-7.1-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-23 17:08:04 -07:00

char_dev.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

compat_binfmt_elf.c

…

coredump.c

Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 14:20:11 -07:00

d_path.c

dcache: permit dynamic_dname()s up to NAME_MAX

2026-04-07 12:32:22 +02:00

dax.c

Merge tag 'libnvdimm-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm

2026-04-21 14:12:01 -07:00

dcache.c

Merge tag 'pull-dcache-busy-wait' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2026-04-21 07:30:44 -07:00

direct-io.c

Merge tag 'mm-stable-2025-07-30-15-25' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2025-07-31 14:57:54 -07:00

drop_caches.c

Coccinelle-based conversion to use ->i_state accessors

2025-10-20 20:22:26 +02:00

eventfd.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

eventpoll.c

eventpoll: drop vestigial epi->dying flag

2026-04-24 00:37:01 +02:00

exec.c

exec: use strnlen() in __set_task_comm

2026-04-01 12:26:07 -07:00

fcntl.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

fhandle.c

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

file_attr.c

Merge tag 'vfs-7.0-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-02-25 10:34:23 -08:00

file_table.c

Merge tag 'lsm-pr-20260410' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm

2026-04-13 15:17:28 -07:00

file.c

Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 14:20:11 -07:00

filesystems.c

sysfs(2): fs_index() argument is _not_ a pathname

2026-01-16 12:52:04 -05:00

fs_context.c

Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 14:20:11 -07:00

fs_dirent.c

fs: rename fs_types.h to fs_dirent.h

2025-11-05 09:51:30 +01:00

fs_parser.c

fs: remove fsparam_path / fs_param_is_path

2026-02-19 14:34:26 +01:00

fs_pin.c

…

fs_struct.c

fs: add <linux/init_task.h> for 'init_fs'

2026-01-14 16:50:37 +01:00

fs-writeback.c

Merge tag 'vfs-7.1-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-23 17:08:04 -07:00

fserror.c

treewide: change inode->i_ino from unsigned long to u64

2026-03-06 14:31:28 +01:00

fsopen.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

init.c

Merge tag 'pull-filename' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2026-02-09 16:58:28 -08:00

inode.c

Merge tag 'pull-dcache-busy-wait' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2026-04-21 07:30:44 -07:00

internal.h

Merge tag 'lsm-pr-20260410' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm

2026-04-13 15:17:28 -07:00

ioctl.c

fs: remove vfs_ioctl export

2025-09-01 13:08:01 +02:00

Kconfig

ntfs: add Kconfig and Makefile

2026-02-19 21:51:00 +09:00

Kconfig.binfmt

binfmt_elf: preserve original ELF e_flags for core dumps

2025-09-03 20:49:32 -07:00

kernel_read_file.c

…

libfs.c

Merge tag 'vfs-7.1-rc1.bh.metadata' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 12:46:42 -07:00

locks.c

Merge tag 'nfsd-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux

2026-04-20 10:44:02 -07:00

Makefile

ntfs: add Kconfig and Makefile

2026-02-19 21:51:00 +09:00

mbcache.c

Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 14:20:11 -07:00

mnt_idmapping.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

mount.h

fs: add immutable rootfs

2026-01-12 16:52:09 +01:00

mpage.c

Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-04-15 12:59:16 -07:00

namei.c

Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 14:20:11 -07:00

namespace.c

mount: always duplicate mount

2026-04-14 09:30:15 +02:00

nsfs.c

Merge tag 'vfs-7.1-rc1.kino' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 12:19:01 -07:00

nullfs.c

fs: add immutable rootfs

2026-01-12 16:52:09 +01:00

open.c

fs: remove do_sys_truncate

2026-03-23 12:41:58 +01:00

pidfs.c

Merge tag 'vfs-7.1-rc1.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 13:27:11 -07:00

pipe.c

treewide: change inode->i_ino from unsigned long to u64

2026-03-06 14:31:28 +01:00

pnode.c

umount_tree(): take all victims out of propagation graph at once

2025-09-15 21:26:44 -04:00

pnode.h

umount_tree(): take all victims out of propagation graph at once

2025-09-15 21:26:44 -04:00

posix_acl.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

proc_namespace.c

…

read_write.c

fs: add setlease to generic_ro_fops and read-only filesystem directory operations

2026-01-12 10:55:45 +01:00

readdir.c

fs: Replace user_access_{begin/end} by scoped user access

2026-03-24 14:44:02 +01:00

remap_range.c

…

select.c

Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 14:20:11 -07:00

seq_file.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

signalfd.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

splice.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

stack.c

…

stat.c

statx: switch to CLASS(filename_maybe_null)

2026-01-16 12:52:04 -05:00

statfs.c

user_statfs(): switch to CLASS(filename)

2026-01-16 12:52:04 -05:00

super.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

sync.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

sysctls.c

…

timerfd.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

userfaultfd.c

userfaultfd: allow registration of ranges below mmap_min_addr

2026-04-18 00:10:56 -07:00

utimes.c

do_utimes_path(): switch to CLASS(filename_uflags)

2026-01-16 12:52:03 -05:00

xattr.c

xattr: support extended attributes on sockets

2026-03-02 11:06:42 +01:00