{"id":181796,"date":"2026-05-29T14:48:11","date_gmt":"2026-05-29T12:48:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/cifswitch-uyazvimost-v-cifs-podsisteme-yadra-linux-pozvolyayushhaya-poluchit-prava-root"},"modified":"2026-05-29T14:48:11","modified_gmt":"2026-05-29T12:48:11","slug":"cifswitch-uyazvimost-v-cifs-podsisteme-yadra-linux-pozvolyayushhaya-poluchit-prava-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/cifswitch-uyazvimost-v-cifs-podsisteme-yadra-linux-pozvolyayushhaya-poluchit-prava-root","title":{"rendered":"CIFSwitch \u2014 a vulnerability in the CIFS subsystem of the Linux kernel that allows gaining root privileges","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Details have been revealed and an exploit for the CIFSwitch vulnerability (CVE not yet assigned) in the CIFS kernel module and cifs-utils toolkit has been published, allowing an unprivileged user to gain root access on the system. The fix is only available as a patch, which was published on May 16 and accepted into the main branch of the Linux kernel on May 19 (corrective kernel releases are not yet available). <\/p>\n

The vulnerability affects the code providing support for the cifs.spnego mechanism for SPNEGO (Simple and Protected GSSAPI Negotiation) authentication when connecting to SMB servers. When using cifs.spnego to derive keys from Kerberos\/SPNEGO, the kernel invokes the cifs.upcall handler provided by the cifs-utils package, executed in user space with root privileges. <\/p>\n

An unprivileged user can initiate a handler call by sending a request for obtaining the key «cifs.spnego» with a forged description «CIFS SPNEGO». The cifs.upcall handler does not perform additional checks for the validity of parameters passed through the kernel; among other things, it accepts trusted values for the fields pid, uid, creduid and
\n upcall_target as trustworthy. After activation, the cifs.upcall handler switches to the namespaces of the user process from which the request was sent, and performs a lookup in the NSS (Name Service Switch) system database before privilege drop.<\/p>\n

The attacker can run their process in a separate mount namespace, which will lead to the NSS query being executed in their context. To exploit the vulnerability, it is sufficient to place their own configuration file \/etc\/nsswitch.conf and a set of dummy libraries libnss_*.so.2 within the environment created by the attacker. Running an NSS query by the cifs.upcall handler will lead to the loading of the substituted libraries with root privileges.<\/p>\n

To exploit the vulnerability, user namespace or mount namespace creation must be allowed on the system, and the cifs-utils package must be installed. Affected distributions with default configuration where exploitation is possible include:<\/p>\n