Copyright © 2012 Red Hat, Inc. All rights reserved.
Important
2026-05-26T00:00:00
kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-825
In the Linux kernel, the following vulnerability has been resolved:
smb: client: reject userspace cifs.spnego descriptions
cifs.spnego key descriptions contain authority-bearing fields such as
pid, uid, creduid, and upcall_target that cifs.upcall treats as
kernel-originating inputs. However, userspace can also create keys of
this type through request_key(2) or add_key(2), allowing those fields to
be supplied without CIFS origin.
Only accept cifs.spnego descriptions while CIFS is using its private
spnego_cred to request the key.
A privilege escalation vulnerability was found in the Linux kernel's CIFS client implementation. This could allow a local attacker to impersonate other users, bypass authentication in SMB mount operations, and potentially gain unauthorized access to network file shares or escalate privileges.
This issue is classified as Important severity primarily because a low-privileged local user can achieve full privilege escalation to root without any user interaction. The attack requires local access, which prevents remote exploitation and is the primary factor keeping the rating at Important rather than Critical.
Exploitation requires three components to be present on the system: the `cifs` kernel module (loaded or loadable), the `cifs-utils` package with its default `cifs.spnego` request-key rule, and the ability to create unprivileged user and mount namespaces. All three must be present for the attack chain to succeed. Environments that do not use SMB/CIFS file shares or Active Directory integration are unlikely to have `cifs-utils` installed, reducing their exposure.
In OpenShift Container Platform 4, this flaw is rated Low. The default `restricted-v2` Security Context Constraint (SCC) sets `allowPrivilegeEscalation: false` on all pods, which causes the kernel to ignore setuid file bits, preventing privilege escalation. Under non-default SCCs such as `anyuid` that permit privilege escalation, the vulnerability is constrained by PID and mount namespace isolation to the container's own filesystem. An attacker would only be able to escalate privileges within the container, not on the host or across pods.
See the security bulletin for a detailed mitigation procedure.
NVIDIA for RHEL 10
2026-06-04T00:00:00Z
RHSA-2026:23395
kernel-0:6.12.0-212.9.el10nv
NVIDIA for RHEL 10
2026-06-30T00:00:00Z
RHSA-2026:33486
kernel-0:6.12.0-231.12.el10nv
Red Hat Enterprise Linux 10
2026-06-04T00:00:00Z
RHSA-2026:23329
kernel-0:6.12.0-211.20.1.el10_2
Red Hat Enterprise Linux 10
2026-06-29T00:00:00Z
RHSA-2026:33225
kpatch-patch
Red Hat Enterprise Linux 10.0 Extended Update Support
2026-06-15T00:00:00Z
RHSA-2026:25908
kernel-0:6.12.0-55.79.1.el10_0
Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION
2026-06-22T00:00:00Z
RHSA-2026:27719
kernel-0:2.6.32-754.61.1.el6
Red Hat Enterprise Linux 7 Extended Lifecycle Support
2026-07-17T00:00:00Z
RHSA-2026:41236
kernel-rt-0:3.10.0-1160.155.1.rt56.1307.el7
Red Hat Enterprise Linux 7 Extended Lifecycle Support
2026-06-22T00:00:00Z
RHSA-2026:27729
kernel-0:3.10.0-1160.153.1.el7
Red Hat Enterprise Linux 8
2026-06-04T00:00:00Z
RHSA-2026:23259
kernel-rt-0:4.18.0-553.129.1.rt7.470.el8_10
Red Hat Enterprise Linux 8
2026-06-04T00:00:00Z
RHSA-2026:23258
kernel-0:4.18.0-553.129.1.el8_10
Red Hat Enterprise Linux 8
2026-06-29T00:00:00Z
RHSA-2026:33220
kpatch-patch
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
2026-06-17T00:00:00Z
RHSA-2026:26535
kernel-0:4.18.0-305.194.1.el8_4
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
2026-06-17T00:00:00Z
RHSA-2026:26535
kernel-0:4.18.0-305.194.1.el8_4
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
2026-06-17T00:00:00Z
RHSA-2026:26570
kernel-0:4.18.0-372.196.1.el8_6
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
2026-06-17T00:00:00Z
RHSA-2026:26570
kernel-0:4.18.0-372.196.1.el8_6
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
2026-06-17T00:00:00Z
RHSA-2026:26563
kernel-0:4.18.0-477.147.1.el8_8
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
2026-06-17T00:00:00Z
RHSA-2026:26563
kernel-0:4.18.0-477.147.1.el8_8
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
2026-06-29T00:00:00Z
RHSA-2026:33219
kpatch-patch
Red Hat Enterprise Linux 9
2026-06-08T00:00:00Z
RHSA-2026:24381
kernel-0:5.14.0-687.13.1.el9_8
Red Hat Enterprise Linux 9
2026-06-08T00:00:00Z
RHSA-2026:24381
kernel-0:5.14.0-687.13.1.el9_8
Red Hat Enterprise Linux 9
2026-06-29T00:00:00Z
RHSA-2026:33224
kpatch-patch
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
2026-06-17T00:00:00Z
RHSA-2026:26515
kernel-0:5.14.0-284.176.1.el9_2
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
2026-06-17T00:00:00Z
RHSA-2026:26462
kernel-rt-0:5.14.0-284.176.1.rt14.461.el9_2
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
2026-06-29T00:00:00Z
RHSA-2026:33221
kpatch-patch
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
2026-06-22T00:00:00Z
RHSA-2026:27735
kernel-0:5.14.0-427.132.1.el9_4
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
2026-06-29T00:00:00Z
RHSA-2026:33222
kpatch-patch
Red Hat Enterprise Linux 9.6 Extended Update Support
2026-06-22T00:00:00Z
RHSA-2026:27708
kernel-0:5.14.0-570.123.1.el9_6
Red Hat Enterprise Linux 9.6 Extended Update Support
2026-06-29T00:00:00Z
RHSA-2026:33223
kpatch-patch
Red Hat OpenShift Container Platform 4.12
2026-07-09T00:00:00Z
RHSA-2026:34048
rhcos-412.86.202606251120-0
Red Hat OpenShift Container Platform 4.13
2026-07-23T00:00:00Z
RHSA-2026:40021
rhcos-413.92.202607141229-0
Red Hat OpenShift Container Platform 4.14
2026-07-01T00:00:00Z
RHSA-2026:28887
rhcos-414.92.202606231112-0
Red Hat OpenShift Container Platform 4.15
2026-07-06T00:00:00Z
RHSA-2026:28962
rhcos-415.92.202606200237-0
Red Hat OpenShift Container Platform 4.16
2026-07-16T00:00:00Z
RHSA-2026:36620
rhcos-416.94.202607021016-0
Red Hat OpenShift Container Platform 4.18
2026-07-08T00:00:00Z
RHSA-2026:34815
rhcos-418.94.202606250458-0
Red Hat OpenShift Container Platform 4.19
2026-07-09T00:00:00Z
RHSA-2026:34757
rhcos-4.19.9.6.202606302000-0
Red Hat OpenShift Container Platform 4.20
2026-07-07T00:00:00Z
RHSA-2026:34788
rhcos-4.20.9.6.202607010620-0
Red Hat OpenShift Container Platform 4.21
2026-07-07T00:00:00Z
RHSA-2026:34764
rhcos-4.21.9.6.202607011303-0
https://www.cve.org/CVERecord?id=CVE-2026-46243
https://nvd.nist.gov/vuln/detail/CVE-2026-46243
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3da1fdf4efbc490041eb4f836bf596201203f8f2
https://lore.kernel.org/linux-cve-announce/2026060140-CVE-2026-46243-3d1c@gregkh/