Description
A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment. A local, low privileged attacker can exploit this by using a crafted request_key payload to trick the root-owned helper into entering a custom environment (namespace) containing a malicious NSS module. This forces the system to load the attacker's controlled NSS Module and configuration, allowing them to execute arbitrary commands as the root user, elevating their privileges and fully compromising the system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cifs-utils | 2:7.8-1 | — |
| Debian 13 | cifs-utils | 2:7.4-1+deb13u1 | — |
| Debian 12 | cifs-utils | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | cifs-utils | 2:7.4-1ubuntu0.26.04.3 | USN-8496-3 |
| Ubuntu 25.10 | cifs-utils | No fix yet | — |
| Ubuntu 24.04 LTS | cifs-utils | 2:7.0-2ubuntu0.5 | USN-8496-3 |
| Ubuntu 22.04 LTS | cifs-utils | 2:6.14-1ubuntu0.6 | USN-8496-3 |
| Ubuntu 20.04 LTS | cifs-utils | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | cifs-utils | No fix yet | — |
| Ubuntu Pro 16.04 LTS | cifs-utils | No fix yet | — |
| Ubuntu Pro 14.04 LTS | cifs-utils | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | cifs-utils +2 | 7.6-1.el10_2 | RHSA-2026:32990 |
| RHEL 9 | cifs-utils +2 | 7.6-2.el9_8 | RHSA-2026:39576 |
| RHEL 8 | cifs-utils +2 | 7.0-5.el8_10 | RHSA-2026:39575 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | cifs-utils +2 | 7.6-2.el9_8 | ALSA-2026:39576 |
| AlmaLinux 8 | cifs-utils +2 | 7.0-5.el8_10 | ALSA-2026:39575 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | cifs-utils | 7.6-1.el10_2 | RLSA-2026:32990 |
| Rocky Linux 9 | cifs-utils | 7.6-2.el9_8 | RLSA-2026:39576 |
| Rocky Linux 8 | cifs-utils | 7.0-5.el8_10 | RLSA-2026:39575 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | cifs-utils | 6.15-150400.3.21.1 | SUSE-SU-2026:2699-1 |
| SLES 15 SP6 | cifs-utils | 6.15-150400.3.21.1 | SUSE-SU-2026:2699-1 |
| SLES 15 SP5 | cifs-utils | 6.15-150400.3.21.1 | SUSE-SU-2026:2699-1 |
| SLES 15 SP4 | cifs-utils | 6.15-150400.3.21.1 | SUSE-SU-2026:2699-1 |
| SLES 12 SP5 | cifs-utils | 6.9-13.26.1 | SUSE-SU-2026:2700-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP6 | cifs-utils | 6.15-150400.3.21.1 | SUSE-SU-2026:2699-1 |
| SLES for SAP 15 SP5 | cifs-utils | 6.15-150400.3.21.1 | SUSE-SU-2026:2699-1 |
| SLES for SAP 15 SP4 | cifs-utils | 6.15-150400.3.21.1 | SUSE-SU-2026:2699-1 |
| SLE Micro 6.1 | cifs-utils | 7.0-slfo.1.1_4.1 | SUSE-SU-2026:22888-1 |
| SLE Micro 5.5 | cifs-utils | 6.15-150400.3.21.1 | SUSE-SU-2026:2699-1 |
| SLE Micro 5.4 | cifs-utils | 6.15-150400.3.21.1 | SUSE-SU-2026:2699-1 |
| SLE Micro 5.3 | cifs-utils | 6.15-150400.3.21.1 | SUSE-SU-2026:2699-1 |
| SLE HPC 15 SP5 | cifs-utils | 6.15-150400.3.21.1 | SUSE-SU-2026:2699-1 |
| SLE HPC 15 SP4 | cifs-utils | 6.15-150400.3.21.1 | SUSE-SU-2026:2699-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | cifs-utils +3 | 7.7-144.amzn2023 | ALAS2023-2026-2030 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cifs-utils | 7.6-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | cifs-utils +2 | 7.6-2.el10_2 | ELSA-2026-32990 |
| Oracle Linux 9 | cifs-utils +2 | 7.6-2.el9_8 | ELSA-2026-39576 |
| Oracle Linux 8 | cifs-utils +2 | 7.0-5.el8_10 | ELSA-2026-39575 |
Advisories 18
- ALSA-2026:39576 Important: cifs-utils security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:39575 Important: cifs-utils security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-2125 Red Hat Enterprise Linux (cifs-utils): Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten BSI CERT-Bund (WID) · Oct 18, 2026
- RHSA-2026:39576 Red Hat Security Advisory: cifs-utils security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:39575 Red Hat Security Advisory: cifs-utils security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:32990 Red Hat Security Advisory: cifs-utils security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- WID-SEC-2026-3043 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- ALAS2023-2026-2030 Important: cifs-utils security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 4, 2026
- SUSE-SU-2026:22888-1 Security update for cifs-utils SUSE / openSUSE Security Updates · Jul 28, 2026
- RLSA-2026:39575 Important: cifs-utils security, bug fix, and enhancement update Rocky Linux Security Advisories · Jul 23, 2026
- ELSA-2026-32990 Important: cifs-utils security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 21, 2026
- RLSA-2026:39576 Important: cifs-utils security, bug fix, and enhancement update Rocky Linux Security Advisories · Jul 15, 2026
- ELSA-2026-39576 Important: cifs-utils security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 15, 2026
- ELSA-2026-39575 Important: cifs-utils security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 15, 2026
- USN-8496-3 cifs-utils vulnerability Ubuntu Security Notices (USN) · Jul 13, 2026
- RLSA-2026:32990 Important: cifs-utils security update Rocky Linux Security Advisories · Jul 5, 2026
- SUSE-SU-2026:2699-1 Security update for cifs-utils SUSE / openSUSE Security Updates · Jul 1, 2026
- SUSE-SU-2026:2700-1 Security update for cifs-utils SUSE / openSUSE Security Updates · Jul 1, 2026
References
- RHSA-2026:32990 vendor-advisory
- RHSA-2026:39575 vendor-advisory
- RHSA-2026:39576 vendor-advisory
- RHSA-2026:44232 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-12505 vdb-entry
- RHBZ#2489805 issue-tracking
- https://git.samba.org/?p=cifs-utils.git;a=commit;h=972c5b5ff95e3e812bc8daa72d0383654ab0dba7