Description
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | cifs-utils | cifs-utils 6.13 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cifs-utils | 2:6.11-3 | — |
| Debian 13 | cifs-utils | 2:6.11-3 | — |
| Debian 12 | cifs-utils | 2:6.11-3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | cifs-utils | 2:6.14-1ubuntu0.1 | USN-5459-1 |
| Ubuntu 20.04 LTS | cifs-utils | 2:6.9-1ubuntu0.2 | USN-5459-1 |
| Ubuntu 18.04 LTS | cifs-utils | 2:6.8-1ubuntu1.2 | USN-5459-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | cifs-utils | 2:6.4-1ubuntu1.1+esm1 | USN-7688-1 |
| Ubuntu Pro 14.04 LTS | cifs-utils | 2:6.0-1ubuntu2+esm1 | USN-7688-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | cifs-utils | 6.9-5.9.1 | SUSE-SU-2021:1161-1 |
| SLES 15 | cifs-utils | 6.9-3.14.1 | SUSE-SU-2021:1455-1 |
| SLES 12 SP5 | cifs-utils | 6.9-13.14.1 | SUSE-SU-2021:1159-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 | cifs-utils | 6.9-3.14.1 | SUSE-SU-2021:1455-1 |
| SLES for SAP 12 SP5 | cifs-utils | 6.9-13.14.1 | SUSE-SU-2021:1159-1 |
| SLE HPC 15 | cifs-utils | 6.9-3.14.1 | SUSE-SU-2021:1455-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cifs-utils | 6.13-1.3 | openSUSE-SU-2024:10683-1 |
| openSUSE Leap 15.2 | cifs-utils | 6.9-lp152.2.3.1 | openSUSE-SU-2021:0639-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | cifs-utils | 6.13-r0 | — |
| Alpine v3.23 | cifs-utils | 6.13-r0 | — |
| Alpine v3.22 | cifs-utils | 6.13-r0 | — |
| Alpine v3.21 | cifs-utils | 6.13-r0 | — |
| Alpine v3.20 | cifs-utils | 6.13-r0 | — |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | cifs-utils | 6.13-r0 | — |
| Alpine v3.18 | cifs-utils | 6.13-r0 | — |
| Alpine v3.17 | cifs-utils | 6.13-r0 | — |
| Alpine v3.16 | cifs-utils | 6.13-r0 | — |
| Alpine v3.15 | cifs-utils | 6.13-r0 | — |
| Alpine v3.14 | cifs-utils | 6.13-r0 | — |
| Alpine v3.13 | cifs-utils | 6.13-r0 | — |
| Alpine v3.12 | cifs-utils | 6.13-r0 | — |
| Alpine v3.11 | cifs-utils | 6.13-r0 | — |
| Alpine v3.10 | cifs-utils | 6.13-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | cifs-utils | 6.8-6 | — |
Advisories 7
- USN-7688-1 cifs-utils vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-5459-1 cifs-utils vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2021:1455-1 Security update for cifs-utils SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1161-1 Security update for cifs-utils SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0639-1 Security update for cifs-utils SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1159-1 Security update for cifs-utils SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10683-1 cifs-utils-6.13-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1921116
- https://bugzilla.samba.org/show_bug.cgi?id=14651
- FEDORA-2021-d54e02d1b2 vendor-advisory
- FEDORA-2021-c87ed13391 vendor-advisory
- FEDORA-2021-b1bb3d3b20 vendor-advisory