CVE-2026-104715

HighCVSS 7.8

Published: 16/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

A flaw in cifs-utils allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a CIFS share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. An attacker can inject unauthorized mount options, bypassing permission checks and executing files with root privileges.

Risk Assessment

A local attacker can gain root privileges, leading to full system compromise. The risk applies to systems where a privileged service mounts CIFS shares using user-controlled credentials files.

Recommendation

Update the cifs-utils package to a patched version. Avoid using user-controlled credentials files in privileged mounting services.

Other vulnerabilities in cifs-utils

CVE-2026-12505High
A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment. A local, low privileged attacker can exploit this by using a crafted request_key payload to trick the root-owned helper into entering a custom environment (namespace) containing a malicious NSS module.

Original NVD description (English source)

A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS