Loading story…
A newly disclosed Linux local privilege escalation vulnerability dubbed CIFSwitch allows a low-privileged user to gain root by exploiting a logic flaw between the kernel CIFS client and the userspace cifs-utils package. Researcher Asim Manizada reported that the kernel does not properly verify whether cifs.spnego key descriptions actually originate from the CIFS subsystem, allowing forged request_key() calls to reach the root-privileged cifs.upcall helper with attacker-controlled input. By manipulating fields including pid and upcall_target, an attacker can steer cifs.upcall into attacker-controlled namespaces and abuse NSS resolution to load a malicious libnss module, resulting in arbitrary code execution as root.
The bug reportedly dates back to 2007 and affects systems running vulnerable kernels together with certain cifs-utils versions, with exploitation depending on conditions such as unprivileged user namespaces and permissive LSM policies. Upstream kernel patches are available, and defenders are being urged to apply fixes quickly while considering interim mitigations such as disabling CIFS where it is not needed, removing cifs-utils, tightening request-key rules, and restricting unprivileged user namespaces. The disclosure follows broader scrutiny of Linux local privilege escalation handling after debate around CopyFail (CVE-2026-31431), where oss-security participants criticized sparse CVE detail, limited early warning, and the difficulty of prioritizing kernel flaws likely to become operationally significant.
Get the actors, campaigns, and ATT&CK mapping behind it.
8 events from the most recent confirmed update back to the earliest known activity.
Coverage of CIFSwitch said the flaw dates back to 2007, affects vulnerable kernels with certain cifs-utils versions, and that upstream kernel patches were available along with mitigation advice such as restricting unprivileged user namespaces and tightening request-key rules.
Asim Manizada published CIFSwitch, describing a Linux local privilege escalation caused by a logic flaw between the kernel CIFS client and cifs-utils that can let a low-privileged user gain root under certain conditions.
Emily Shepherd and others used the CVE-2026-31431 case on oss-security to argue that the Linux kernel disclosure workflow is opaque, places too much burden on reporters, and produces CVE descriptions that lack useful threat and mitigation detail.
Responding on oss-security, Greg Kroah-Hartman said the kernel security team focuses on triaging reports, involving maintainers, and getting fixes merged quickly, and that it does not make vulnerability announcements.
An oss-security thread stated that xint had supplied the Linux kernel security team with a fully working exploit when reporting CVE-2026-31431, and referenced public materials including the copy.fail site, a detailed blog post, and a Python proof of concept.
Participants on oss-security discussed operational mitigations for CVE-2026-31431, noting that when vulnerable functionality is modular it may be disabled or unloaded, while kernels with the code built in may require a boot parameter change and reboot.
An oss-security discussion covered how CVE-2026-31431 was prioritized, with Greg Kroah-Hartman saying users should update to the latest release and that the CVE team did not know exploitation was imminent or provide advance notice to selected parties such as distros.
In an oss-security mailing list message, Greg Kroah-Hartman said the CVE entry for CVE-2026-31431 (CopyFail) already included a severity score and advised supported users to ask their Linux distribution vendor about handling under support contracts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
12 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceheyitsas.im
Open sourceopenwall.com
Open sourceopenwall.com
Open sourceopenwall.com
Open sourceopenwall.com
Open sourceopenwall.com
Open sourceopenwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Linux local privilege-escalation flaw dubbed **CIFSwitch** has been disclosed and assigned **`CVE-2026-46243`**, exposing systems that combine the kernel CIFS client with vulnerable **`cifs-utils`** configurations. Researcher Asim Manizada reported that an unprivileged user can forge a **`cifs.spnego`** key request, causing the root-run **`cifs.upcall`** helper to trust attacker-controlled fields such as identity and namespace targets. In affected versions, the helper can switch into attacker-controlled namespaces and perform NSS lookups before dropping privileges, allowing a malicious **`libnss_*.so.2`** to execute as root. Reports say the underlying logic bug has existed since 2007, and public technical details and a proof of concept are now available. The issue affects multiple distributions under common conditions, with several reported as exploitable by default, including Linux Mint, CentOS Stream 9, Rocky Linux 9, AlmaLinux 9, Kali Linux, and SLES 15, while Ubuntu, Debian, Oracle Linux, openSUSE Leap, and others can become vulnerable when **`cifs-utils`** is installed and user namespaces are enabled. Some newer platforms are partially protected by default SELinux or AppArmor policies, but vendors warned those controls are only defense in depth. Upstream fixed the bug in kernel commit **`3da1fdf4efbc`**, which rejects userspace-originated **`cifs.spnego`** descriptions, and distributors have begun shipping patched kernels. Administrators are being urged to patch and reboot, or temporarily mitigate by removing **`cifs-utils`**, blacklisting the CIFS kernel module, overriding the **`cifs.spnego`** request-key rule, or disabling unprivileged user namespaces.
Jun 29, 2026
A local privilege escalation flaw in Linux systems using **CIFS/Kerberos authentication** and `cifs-utils` can allow an unprivileged user to execute code as **root** by abusing the `cifs.spnego` `request-key` mechanism. The issue arises because the `cifs.upcall` helper may be invoked with elevated privileges and can be influenced through **Name Service Switch (NSS)** resolution, enabling an attacker to load a malicious `libnss_*.so.2` library under certain namespace and configuration conditions. Testing cited in the reports found many Linux distributions vulnerable, while some were protected by default through **SELinux** or **AppArmor** policies that blocked exploitation despite shipping affected behavior. Recommended mitigations included disabling the **CIFS kernel module**, turning off **unprivileged user namespaces**, or overriding the `cifs.spnego` request-key rule so requests are denied instead of passed to the helper; the reports also noted broad disclosure activity across distributions and a large number of related vulnerability reports awaiting review.
Jun 29, 2026
Researchers disclosed **CVE-2026-31431**, dubbed **CopyFail**, a Linux local privilege escalation flaw in the kernel crypto subsystem's `algif_aead`/`AF_ALG` AEAD path that lets a low-privileged local user corrupt the page cache of readable files and gain root. The bug traces to a 2017 in-place AEAD optimization introduced in Linux 4.14 by commit `72548b093ee3`, which allowed splice-backed file pages to be reused as writable crypto buffers; attackers can then achieve a controlled write into the cached copy of targets such as setuid binaries while leaving the on-disk file unchanged. Researchers published a compact Python proof of concept said to work reliably across major distributions including Ubuntu, RHEL, SUSE, Amazon Linux, Debian, Fedora, and Arch, and warned the shared page cache also makes the flaw relevant for container escapes, CI runners, and multi-tenant cloud hosts. Upstream fixed the issue by reverting `algif_aead` to out-of-place operation in Linux **7.0**, **6.19.12**, and **6.18.22**, while older long-term branches initially lagged because the patch did not apply cleanly and required backports or workaround patches. Major vendors and downstream projects began shipping advisories and kernel updates, and temporary mitigations included disabling or blacklisting `algif_aead`, blocking `AF_ALG` socket creation with seccomp or eBPF, or using the kernel boot parameter `initcall_blacklist=algif_aead_init` where the feature was built in. After public exploit code spread and additional exploit ports appeared, **CISA added the flaw to its Known Exploited Vulnerabilities catalog**, and defenders published detections focused on suspicious `AF_ALG`, `splice()`, and setuid execution activity because traditional file-integrity checks may miss the in-memory-only tampering.
Aug 25, 2026