Executive brief
A security vulnerability in the cifs-utils package, which provides tools for managing network file shares, could allow a local user to take full control of a Linux system. By tricking a background system process into loading a malicious file from a user-controlled area, an attacker with limited access can gain full administrative (root) privileges. This could lead to the theft of sensitive data, system-wide outages, or the installation of persistent malware.
Technical details
A flaw was found in the cifs.upcall helper within the cifs-utils package (CWE-250). The helper fails to securely drop root privileges before switching into attacker-controlled namespaces to perform user information lookups via getpwuid(). A local attacker can trigger a crafted cifs.spnego request using the request_key() system call, forcing the root-owned helper to enter a malicious namespace containing a rogue Name Service Switch (NSS) module and configuration. Because the helper retains privileged kernel credentials during this transition, it loads and executes the attacker's malicious NSS module as the root user. A fix has been identified in the upstream cifs-utils repository that removes the getpwuid() dependency and ensures privileges are dropped earlier.
Affected products
- Samba cifs-utils All versions prior to commit 972c5b5ff95e3e812bc8daa72d0383654ab0dba7
- Red Hat Red Hat Enterprise Linux 7 affected
- Red Hat Red Hat Enterprise Linux 8 affected
- Red Hat Red Hat Enterprise Linux 9 affected
- Red Hat Red Hat Enterprise Linux 10 affected
- Red Hat Red Hat OpenShift Container Platform 4 affected
Timeline
- 2026-06-15: patched: Upstream patch committed to cifs-utils repository
- 2026-06-17: disclosed: Reported to Red Hat Bugzilla
- 2026-06-18: advisory: CVE published and NVD record created