p PatchFirst

CVE-2026-12505

CVE-2026-12505 · Cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment. A local, low privileged attacker can exploit this by using a crafted request_key payload to trick the root-owned helper into entering a custom environment (namespace) containing a malicious NSS module. This forces the system to load the attacker's controlled NSS Module and configuration, allowing them to execute arbitrary commands as the root user, elevating their privileges and fully compromising the system.

CVSS 7.8 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • red hat enterprise linux 10

    Versions
    • ≥ 0:7.6-1.el10_2: Not affected (rpm)

    No fix published

  • red hat enterprise linux 8

    Versions
    • ≥ 0:7.0-5.el8_10: Not affected (rpm)

    No fix published

  • red hat enterprise linux 9

    Versions
    • ≥ 0:7.6-2.el9_8: Not affected (rpm)

    No fix published

  • red hat openshift container platform 4.22

    Versions
    • ≥ 4.22.9.8.202607220526-0: Not affected (rpm)

    No fix published

  • red hat enterprise linux 6

    No fix published

  • red hat enterprise linux 7

    No fix published

  • red hat openshift container platform 4

    No fix published

  • cifs-utils Debian:12

    Versions
    • 2:7.0-2
    • 2:7.0-2.1
    • 2:7.1-1
    • 2:7.2-1
    • 2:7.2-2
    • 2:7.3-1
    • 2:7.4-1
    • 2:7.8-1
    • 2:7.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cifs-utils Debian:13

    Versions
    • 2:7.4-1
    Affected ranges
    • ECOSYSTEM: < 2:7.4-1+deb13u1

    Update to 2:7.4-1+deb13u1

  • cifs-utils Debian:14

    Versions
    • 2:7.4-1
    Affected ranges
    • ECOSYSTEM: < 2:7.8-1

    Update to 2:7.8-1

  • cifs-utils Ubuntu:Pro:14.04:LTS

    Versions
    • 2:6.0-1ubuntu2
    • 2:6.0-1ubuntu2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cifs-utils Ubuntu:Pro:16.04:LTS

    Versions
    • 2:6.4-1ubuntu1
    • 2:6.4-1ubuntu1.1
    • 2:6.4-1ubuntu1.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cifs-utils Ubuntu:18.04:LTS

    Versions
    • 2:6.7-1
    • 2:6.8-1
    • 2:6.8-1ubuntu1
    • 2:6.8-1ubuntu1.1
    • 2:6.8-1ubuntu1.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cifs-utils Ubuntu:20.04:LTS

    Versions
    • 2:6.9-0ubuntu1
    • 2:6.9-1
    • 2:6.9-1ubuntu0.1
    • 2:6.9-1ubuntu0.2
    • 2:6.9-1ubuntu0.3
    • 2:6.9-1ubuntu0.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cifs-utils Ubuntu:22.04:LTS

    Versions
    • 2:6.11-3.1
    • 2:6.14-1
    • 2:6.14-1build1
    • 2:6.14-1ubuntu0.1
    • 2:6.14-1ubuntu0.2
    • 2:6.14-1ubuntu0.3
    • 2:6.14-1ubuntu0.4
    • 2:6.14-1ubuntu0.5
    Affected ranges
    • ECOSYSTEM: < 2:6.14-1ubuntu0.6

    Update to 2:6.14-1ubuntu0.6

  • cifs-utils Ubuntu:24.04:LTS

    Versions
    • 2:7.0-2
    • 2:7.0-2build1
    • 2:7.0-2ubuntu0.1
    • 2:7.0-2ubuntu0.2
    • 2:7.0-2ubuntu0.3
    • 2:7.0-2ubuntu0.4
    Affected ranges
    • ECOSYSTEM: < 2:7.0-2ubuntu0.5

    Update to 2:7.0-2ubuntu0.5

  • cifs-utils Ubuntu:25.10

    Versions
    • 2:7.2-2
    • 2:7.3-1
    • 2:7.4-1
    • 2:7.4-1ubuntu0.25.10.1
    • 2:7.4-1ubuntu0.25.10.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cifs-utils Ubuntu:26.04:LTS

    Versions
    • 2:7.4-1
    • 2:7.4-1build1
    • 2:7.4-1ubuntu0.26.04.1
    • 2:7.4-1ubuntu0.26.04.2
    Affected ranges
    • ECOSYSTEM: < 2:7.4-1ubuntu0.26.04.3

    Update to 2:7.4-1ubuntu0.26.04.3

Original sources

Check your server →