CVE-2026-12505: Samba cifs-utils privilege escalation in cifs.upcall

CVE-2026-12505 · Severity: high · CVSS 7.8 · Published 2026-06-18

A security vulnerability in the cifs-utils package, which provides tools for managing network file shares, could allow a local user to take full control of a Linux system. By tricking a background system process into loading a malicious file from a user-controlled area, an attacker with limited access can gain full administrative (root) privileges. This could lead to the theft of sensitive data, system-wide outages, or the installation of persistent malware.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4. Vendors: Red Hat, Samba.

Quick answers

Is CVE-2026-12505 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-12505 being exploited in the wild.
How severe is CVE-2026-12505?
High severity, with a CVSS score of 7.8, published 18 June 2026.
Which products and versions are affected?
Red Hat Enterprise Linux 10 affected; Red Hat Enterprise Linux 7 affected; Red Hat Enterprise Linux 8 affected; Red Hat Enterprise Linux 9 affected; and 2 more.
Is there a fix for CVE-2026-12505?
A patch was published on 2026-06-15: Upstream patch committed to cifs-utils repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12505 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-12505?
Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A flaw was found in the cifs.upcall helper within the cifs-utils package (CWE-250). The helper fails to securely drop root privileges before switching into attacker-controlled namespaces to perform user information lookups via getpwuid(). A local attacker can trigger a crafted cifs.spnego request using the request_key() system call, forcing the root-owned helper to enter a malicious namespace containing a rogue Name Service Switch (NSS) module and configuration. Because the helper retains privileged kernel credentials during this transition, it loads and executes the attacker's malicious NSS module as the root user. A fix has been identified in the upstream cifs-utils repository that removes the getpwuid() dependency and ensures privileges are dropped earlier.

Affected products

  • Samba cifs-utils All versions prior to commit 972c5b5ff95e3e812bc8daa72d0383654ab0dba7
  • Red Hat Red Hat Enterprise Linux 7 affected
  • Red Hat Red Hat Enterprise Linux 8 affected
  • Red Hat Red Hat Enterprise Linux 9 affected
  • Red Hat Red Hat Enterprise Linux 10 affected
  • Red Hat Red Hat OpenShift Container Platform 4 affected

Timeline

  • 2026-06-15: patched: Upstream patch committed to cifs-utils repository
  • 2026-06-17: disclosed: Reported to Red Hat Bugzilla
  • 2026-06-18: advisory: CVE published and NVD record created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.