RHSB-2026-005 CIFS Upcall Privilege Escalation - Linux Kernel (CVE-2026-46243) - "CIFSwitch"

Executive Summary

A vulnerability has been identified in the Linux kernel's CIFS (SMB) client subsystem. A low-privileged local user could exploit this flaw to execute arbitrary commands as root.

Red Hat has assessed this issue with a severity of Important. Fixes have been released for all affected products. This flaw is tracked as CVE-2026-46243.

Note: Environments without Windows file servers or Active Directory typically do not require CIFS functionality. Disabling the cifs kernel module, removing the cifs-utils package, or deactivating the cifs.spnego request-key rule will each disrupt the attack chain, as all three must be present for exploitation. Of these, disabling the kernel module is the most practical and recommended approach — see the Mitigation section below. Restricting local access to trusted users also helps reduce the risk of exploitation.

Affected Products

The following products are affected:

• Red Hat Enterprise Linux 10 (All fixes released)
• Red Hat Enterprise Linux 9 (All fixes released)
• Red Hat Enterprise Linux 8 (All fixes released)
• Red Hat Enterprise Linux 7 (All fixes released)
• Red Hat Enterprise Linux 6 (All fixes released)
• Red Hat OpenShift Container Platform 4 (All fixes released — Low severity; exploitation requires local access, which is restricted by default Security Context Constraints)

Further, any Red Hat product that relies on the Red Hat Enterprise Linux kernel is also potentially impacted. This includes layered products such as Red Hat OpenStack Platform and Red Hat Virtualization.

Technical Summary

By abusing the request_key(2) syscall to fabricate cifs.spnego key descriptions, an attacker can cause the privileged Kerberos helper cifs.upcall to execute with parameters under the attacker's control. Combined with Linux user namespace and mount namespace manipulation, the attacker can force cifs.upcall to load a malicious NSS shared library, achieving local privilege escalation.

The flaw exists in fs/smb/client/cifs_spnego.c, which registers the cifs.spnego key type without validating that key creation requests originate from the kernel's CIFS subsystem. The key description embeds identity and targeting fields — upcall_target, creduid, uid, and pid — that cifs.upcall assumes were set by the kernel's CIFS subsystem — but userspace can also create keys of this type, supplying crafted values for these fields.

Mitigation

Overall Guidance

Applying the kernel fix is the only comprehensive remediation. The mitigation below reduces the attack surface but does not address the root cause.

Disabling the CIFS kernel module

If SMB/CIFS client functionality is not required, disable or blocklist the cifs kernel module.

Warning: This prevents all CIFS/SMB client mounts on the system. Evaluate whether SMB file shares or DFS are used in your environment before applying. If the cifs module is already loaded, it must be unloaded for the blacklist to take effect. Unmount any active CIFS shares first, then unload with modprobe -r cifs. If unmounting is not possible, a reboot is required.

echo "blacklist cifs" > /etc/modprobe.d/disable-cifs.conf

Monitoring for exploitation

If deploying the above mitigation is not feasible, the following monitoring approach can help detect exploitation attempts.

Audit userspace key creation using auditd. The following rule logs key-related system calls that may be involved in exploitation attempts:

auditctl -a always,exit -F arch=b64 -S add_key -S request_key -k keyring_monitor

Review the audit log for entries tagged with keyring_monitor. Entries showing request_key calls with cifs.spnego key descriptions originating from non-kernel processes may indicate exploitation attempts.