Summary
It was discovered that cifs-utils incorrectly handled credentials files
used by privileged mount.cifs invocations. A local attacker could
possibly use this issue to inject arbitrary mount options into a
privileged mount, resulting in a privilege escalation.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | cifs-utils | 2:6.14-1ubuntu0.7 |
| Ubuntu · 24.04 LTS 24.04:LTS | cifs-utils | 2:7.0-2ubuntu0.6 |
| Ubuntu · 26.04 LTS 26.04:LTS | cifs-utils | 2:7.4-1ubuntu0.26.04.4 |
| Ubuntu · 26.10 | cifs-utils | 2:7.4-1ubuntu3.1 |
Vulnerabilities 1
-
High 7.8CVE-2026-104715 Public exploit
Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sa…
References
-
report
https://ubuntu.com/security/CVE-2026-104715