Junglewise Threat Intelligence

CVE-2026-46243: Linux Kernel SMB client improper validation of cifs.spnego keys

CVE-2026-46243 · Severity: info · CVSS 0 · Published 2026-06-01

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's SMB (CIFS) client that could allow local users to manipulate security-sensitive fields. The SMB client uses a mechanism called SPNEGO for network authentication, which relies on 'keys' that should only be created by the kernel. However, a flaw allowed regular userspace programs to create these keys, potentially tricking the system into using unauthorized credentials or process IDs during network authentication tasks. This could lead to unauthorized access to network shares or local privilege escalation.

Technical details

A vulnerability in the Linux kernel SMB client (CIFS) stems from the lack of validation on the origin of 'cifs.spnego' key descriptions. These descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target, which the cifs.upcall helper treats as trusted kernel-originating inputs. An attacker can use the add_key(2) or request_key(2) system calls from userspace to create these keys with arbitrary values. This allows a local attacker to spoof credentials or targets during the SPNEGO authentication process. The fix introduces a vetting function (cifs_spnego_key_vet_description) that ensures these keys are only accepted when requested by the CIFS kernel client using its private credentials (spnego_cred).

Affected products

  • Linux Linux Kernel v6.4-rc1 and earlier versions back to v2.6.11

Timeline

  • 2026-05-16: other: Patch authored
  • 2026-06-01: advisory: NVD published CVE-2026-46243
  • 2026-06-01: patched: Merged into various stable kernel branches

References

Related threats