Skip to main content

cifs-utils CVE-2026-12505

| EUVDEUVD-2026-37834 HIGH
Execution with Unnecessary Privileges (CWE-250)
2026-06-18 redhat GHSA-58j9-p7xf-pjx7
Privilege Escalation Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Openshift Container Platform 4 Red Hat
7.8
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local-only via request_key with any unprivileged account (AV:L, PR:L); no user interaction or special conditions on default RHEL (AC:L, UI:N); root code execution yields full C/I/A impact within the host scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
7.8 HIGH
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jun 18, 2026 - 04:45 vuln.today
CVE Published
Jun 18, 2026 - 03:34 cve.org
HIGH 7.8

DescriptionCVE.org

A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment. A local, low privileged attacker can exploit this by using a crafted request_key payload to trick the root-owned helper into entering a custom environment (namespace) containing a malicious NSS module. This forces the system to load the attacker's controlled NSS Module and configuration, allowing them to execute arbitrary commands as the root user, elevating their privileges and fully compromising the system.

AnalysisAI

Local privilege escalation in the cifs-utils cifs.upcall helper allows low-privileged Linux users to gain root by abusing the kernel request_key interface to load a malicious NSS module inside an attacker-controlled mount namespace. The root-owned helper fails to drop privileges before performing user-name resolution, so the attacker's NSS module executes with full root capabilities. No public exploit identified at time of analysis, but the bug affects every supported Red Hat Enterprise Linux release (6 through 10) and OpenShift Container Platform 4, making it a high-priority hardening fix for any host with CIFS/SMB client functionality.

Technical ContextAI

cifs-utils ships cifs.upcall, a SUID/root helper invoked by the kernel via the request_key upcall mechanism to obtain Kerberos credentials and resolve UID/GID information for CIFS/SMB mounts. The flaw is a classic CWE-250 (Execution with Unnecessary Privileges): the helper performs NSS lookups (getpwuid/getgrgid style calls backed by /etc/nsswitch.conf modules) while still holding root, and does so after the calling process has been able to influence its execution environment - specifically the mount namespace and library search paths. Because glibc's NSS dispatcher dlopen()s shared objects named in nsswitch.conf, a caller who controls the namespace can present an attacker-written nsswitch.conf and a malicious libnss_*.so, which is then loaded and executed inside the root-privileged helper, turning a credential-resolution code path into arbitrary code execution.

RemediationAI

Upstream fix available (commit 972c5b5ff95e3e812bc8daa72d0383654ab0dba7 in git.samba.org cifs-utils); released patched version not independently confirmed in the supplied data, so consume the cifs-utils errata package from your distribution (Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12505, equivalent SUSE update once published) and verify the installed cifs-utils build includes that commit. Until the package is updated, compensating controls include removing the setuid bit from /sbin/cifs.upcall or restricting its execution via an AppArmor/SELinux profile (side effect: krb5-authenticated CIFS mounts will fail for non-root users), disabling the request-key handler for the cifs key type in /etc/request-key.conf (side effect: breaks automatic credential upcalls), and on OpenShift restricting workloads' ability to call request_key or create user/mount namespaces via SCCs or seccomp profiles (side effect: may break legitimate containers that perform CIFS mounts or use keyrings).

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

Same weakness CWE-250 – Execution with Unnecessary Privileges

View all
CVE-2023-52030 CRITICAL POC
9.8
CVE-2025-57119 CRITICAL POC
9.8
CVE-2024-25421 CRITICAL POC
9.8
CVE-2023-46360 HIGH POC
8.8
CVE-2024-6913 CRITICAL POC
9.3
CVE-2022-1808 HIGH POC
8.8
CVE-2022-0071 HIGH POC
8.8
CVE-2022-0070 HIGH POC
8.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

CVE-2026-12505 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy