Loading vulnerability…
CIFSwitch
CIFSwitch is a local privilege-escalation vulnerability in the Linux kernel SMB/CIFS client's validation of cifs.spnego key descriptions. Userspace processes can create these keys through request_key() or add_key() and supply authority-bearing pid, uid, creduid, and upcall_target fields that the cifs-utils cifs.upcall helper treats as trusted kernel-originating inputs. On exploitable configurations, a forged request invokes the helper as root and directs it into an attacker-controlled namespace. An account lookup through getpwuid() then loads attacker-controlled Name Service Switch (NSS) code before the helper completes its identity transition and capability drop, permitting root-level code execution. Exploitability depends on the distribution, helper version, request-key configuration, namespace availability, and security policy.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unprivileged local attacker can escalate to host root on susceptible configurations by executing malicious NSS code within the privileged authentication helper. Root execution permits access to protected information, modification of system security controls, and disruption of services. A public proof of concept demonstrates persistent privilege elevation by installing a sudo authorization rule. The kernel validation flaw does not establish that every affected distribution is exploitable through this chain.
If you can’t patch tonight, do this now.
If CIFS is unnecessary, prevent the cifs module from loading; this measure does not apply when CIFS is built into the kernel. Remove unnecessary cifs-utils installations, or disable the cifs.spnego request-key rule where CIFS Kerberos authentication is not required. Disabling unprivileged user namespaces blocks the described namespace-based exploit. SELinux, AppArmor, or other mandatory access-control policies may also prevent exploitation, but effectiveness depends on the deployed policy and distribution. Restrict untrusted local access until remediation is complete.
Patch, then assume compromise.
Apply a vendor-supported Linux kernel update containing the cifs.spnego origin-validation fix. The fix adds cifs_spnego_key_vet_description() and accepts descriptions only when current_cred() matches CIFS's private spnego_cred, blocking userspace-forged requests. Boot into the fixed kernel after installation, or apply a supported live patch explicitly covering this CVE for the running kernel. RHEL 10.0 provides the fix in kernel version 6.12.0-55.79.1.el10_0 under RHSA-2026:25908; other streams require their corresponding vendor updates. ExtremeAnalytics, ExtremeCloud IQ - Site Engine, and ExtremeControl for Site Engine should be upgraded to version 26.8.10 or later. The kernel fix blocks the described exploit independently of additional userspace hardening.
1 exploit validated by Mallory's analysis. Hidden: 4 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
96 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.