Loading story…
A local privilege escalation flaw in Linux systems using CIFS/Kerberos authentication and cifs-utils can allow an unprivileged user to execute code as root by abusing the cifs.spnego request-key mechanism. The issue arises because the cifs.upcall helper may be invoked with elevated privileges and can be influenced through Name Service Switch (NSS) resolution, enabling an attacker to load a malicious libnss_*.so.2 library under certain namespace and configuration conditions.
Testing cited in the reports found many Linux distributions vulnerable, while some were protected by default through SELinux or AppArmor policies that blocked exploitation despite shipping affected behavior. Recommended mitigations included disabling the CIFS kernel module, turning off unprivileged user namespaces, or overriding the cifs.spnego request-key rule so requests are denied instead of passed to the helper; the reports also noted broad disclosure activity across distributions and a large number of related vulnerability reports awaiting review.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
A Linux kernel stable-tree patch hardened the CIFS SMB client by rejecting userspace-created cifs.spnego key descriptions unless they originate from the private spnego_cred context. The change was intended to stop forged authority-bearing fields from being passed to cifs.upcall as if they were kernel-originating data.
A write-up disclosed a local privilege escalation vulnerability involving the Linux CIFS/Kerberos authentication path, where the cifs.spnego request-key handler can invoke cifs.upcall as root and be abused via NSS to load attacker-controlled libraries. The disclosure noted many Linux distributions were affected or exploitable depending on namespace availability and SELinux/AppArmor protections, and suggested mitigations such as disabling the CIFS module, disabling unprivileged user namespaces, or overriding the cifs.spnego rule.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
git.kernel.org
Open sourceopennet.me
Open sourceopennet.ru
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly disclosed Linux local privilege escalation vulnerability dubbed **CIFSwitch** allows a low-privileged user to gain **root** by exploiting a logic flaw between the kernel CIFS client and the userspace `cifs-utils` package. Researcher Asim Manizada reported that the kernel does not properly verify whether `cifs.spnego` key descriptions actually originate from the CIFS subsystem, allowing forged `request_key()` calls to reach the root-privileged `cifs.upcall` helper with attacker-controlled input. By manipulating fields including `pid` and `upcall_target`, an attacker can steer `cifs.upcall` into attacker-controlled namespaces and abuse NSS resolution to load a malicious `libnss` module, resulting in arbitrary code execution as root. The bug reportedly dates back to 2007 and affects systems running vulnerable kernels together with certain `cifs-utils` versions, with exploitation depending on conditions such as unprivileged user namespaces and permissive LSM policies. Upstream kernel patches are available, and defenders are being urged to apply fixes quickly while considering interim mitigations such as disabling CIFS where it is not needed, removing `cifs-utils`, tightening `request-key` rules, and restricting unprivileged user namespaces. The disclosure follows broader scrutiny of Linux local privilege escalation handling after debate around **CopyFail** (`CVE-2026-31431`), where oss-security participants criticized sparse CVE detail, limited early warning, and the difficulty of prioritizing kernel flaws likely to become operationally significant.
Jun 29, 2026
A Linux local privilege-escalation flaw dubbed **CIFSwitch** has been disclosed and assigned **`CVE-2026-46243`**, exposing systems that combine the kernel CIFS client with vulnerable **`cifs-utils`** configurations. Researcher Asim Manizada reported that an unprivileged user can forge a **`cifs.spnego`** key request, causing the root-run **`cifs.upcall`** helper to trust attacker-controlled fields such as identity and namespace targets. In affected versions, the helper can switch into attacker-controlled namespaces and perform NSS lookups before dropping privileges, allowing a malicious **`libnss_*.so.2`** to execute as root. Reports say the underlying logic bug has existed since 2007, and public technical details and a proof of concept are now available. The issue affects multiple distributions under common conditions, with several reported as exploitable by default, including Linux Mint, CentOS Stream 9, Rocky Linux 9, AlmaLinux 9, Kali Linux, and SLES 15, while Ubuntu, Debian, Oracle Linux, openSUSE Leap, and others can become vulnerable when **`cifs-utils`** is installed and user namespaces are enabled. Some newer platforms are partially protected by default SELinux or AppArmor policies, but vendors warned those controls are only defense in depth. Upstream fixed the bug in kernel commit **`3da1fdf4efbc`**, which rejects userspace-originated **`cifs.spnego`** descriptions, and distributors have begun shipping patched kernels. Administrators are being urged to patch and reboot, or temporarily mitigate by removing **`cifs-utils`**, blacklisting the CIFS kernel module, overriding the **`cifs.spnego`** request-key rule, or disabling unprivileged user namespaces.
Jun 29, 2026
Researchers disclosed **Fragnesia** (`CVE-2026-46300`), a Linux kernel local privilege escalation flaw that allows an unprivileged local user to gain **root** by corrupting the kernel page cache for read-only files. The bug, discovered by William Bowling of Zellic and the V12 team, is described as a new variant in the Dirty Frag family and affects Linux kernels released before May 13, 2026. It stems from faulty bookkeeping when shared page fragments are merged in socket buffers and can be triggered through the kernel's XFRM **ESP-in-TCP** path, with additional exposure through `rxrpc` on some systems. A public proof-of-concept exploit modifies the in-memory copy of files such as `/usr/bin/su` to spawn a root shell while leaving the on-disk binary unchanged, reducing forensic visibility. Vendors and distributions moved quickly to publish advisories, patches, and mitigations as exploit code became public. AlmaLinux said releases 8, 9, and 10 are affected through `esp4` and `esp6`, with AlmaLinux 9 and 10 also exposed through `rxrpc` when `kernel-modules-partner` is installed, and released backported fixes ahead of upstream vendor updates. Recommended mitigations include disabling or blacklisting the `esp4`, `esp6`, and `rxrpc` kernel modules, restricting unprivileged user namespaces, and monitoring for suspicious namespace creation or XFRM manipulation; AlmaLinux also advised dropping page cache if compromise is suspected. The disclosure comes amid heightened concern over Linux local-root bugs in the same code area, and one cybercrime forum post reportedly advertised a Linux LPE zero-day for sale for **$170,000**.
Jun 29, 2026