CVE-2026-64137
Description
A flaw was found in the Linux kernel's Common Internet File System (CIFS) client. This vulnerability allows an unprivileged local user to send witness notifications or join a specific multicast group without proper administrative privileges. Exploiting this flaw could lead to information disclosure, as sensitive data such as usernames, domains, and passwords from NTLM-authenticated mounts might be exposed to the unauthorized process. This issue arises from missing capability checks in the generic netlink operations for CIFS witness notifications.
Statement
A flaw was found in the Linux kernel's CIFS client witness notification (SWN) generic netlink interface. The CIFS_GENL_CMD_SWN_NOTIFY command and the CIFS_GENL_MCGRP_SWN multicast group were exposed without capability checks, so an unprivileged local process could send RESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness handler and could join the SWN multicast group to receive witness register messages. Those messages include the witness registration id and, for NTLM-authenticated mounts, the username, domain, and password attributes copied from the CIFS session, so exploitation could allow a local attacker to disclose SMB session credentials. Red Hat Product Security has rated this flaw as IMPORTANT with a CVSS 3.1 score of 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), lower than the 7.8 score assigned by CVE.org (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a higher attack complexity. No Red Hat products are affected by this flaw: all shipped Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams are recorded as not affected because the vulnerable code is not present in the shipped kernels.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
