Summary
[7.6-2]
- resolves: RHEL-192982 - fix krb5 mount regression
[7.6-1]
- Update to version 7.6
- resolves: RHEL-185761 - CVE-2026-12505 cifs-utils: LPE via cifs.spnego
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | cifs-utils | 0:7.6-2.el9_8 |
| Oracle Linux · 9 | cifs-utils-devel | 0:7.6-2.el9_8 |
| Oracle Linux · 9 | pam_cifscreds | 0:7.6-2.el9_8 |
Vulnerabilities 1
-
High 7.8
Cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall
A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment. A local, low privileged attacker can exploit this by using a crafted re…