Skip to main content

Linux Kernel CVE-2026-64137

| EUVDEUVD-2026-45822 HIGH
2026-07-19 Linux GHSA-5vrr-7h3c-f6hv
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.1 MEDIUM

Local unprivileged process (AV:L/PR:L) leaks cleartext CIFS credentials (C:H); spoofed witness notifications give limited integrity impact (I:L); no availability effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 17:40 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:40 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:40 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smb: client: require net admin for CIFS SWN netlink

CIFS_GENL_CMD_SWN_NOTIFY is the userspace witness-notify command. The intended sender is the cifs.witness helper, but the generic-netlink operation currently has no capability flag, so any local process can send RESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness handler.

The same family exposes CIFS_GENL_MCGRP_SWN without multicast-group capability flags. Register messages sent to that group include the witness registration id and, for NTLM-authenticated mounts, the username, domain, and password attributes copied from the CIFS session. An unprivileged local process should not be able to join that group and receive those messages.

Require CAP_NET_ADMIN for incoming SWN_NOTIFY commands with GENL_ADMIN_PERM, and require CAP_NET_ADMIN over the network namespace for joining the SWN multicast group with GENL_MCAST_CAP_NET_ADMIN. The cifs.witness service runs with the privileges needed for both operations.

AnalysisAI

Local credential disclosure in the Linux kernel CIFS/SMB client (kernel 5.11 and later) stems from the CIFS_GENL generic-netlink family exposing the SWN (witness-notify) command and its CIFS_GENL_MCGRP_SWN multicast group without capability enforcement. Any unprivileged local process can join the multicast group to receive witness Register messages that, for NTLM-authenticated mounts, contain the session username, domain, and cleartext password, and can also inject spoofed RESOURCE_CHANGE or CLIENT_MOVE notifications into the in-kernel witness handler. No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a local-only issue.

Technical ContextAI

The affected component is the SMB/CIFS witness (SWN) subsystem of the in-kernel cifs client, which uses generic netlink to communicate with the userspace cifs.witness helper. Generic-netlink operations are gated by per-command capability flags; here the CIFS_GENL_CMD_SWN_NOTIFY operation was registered without GENL_ADMIN_PERM, and the CIFS_GENL_MCGRP_SWN multicast group was registered without GENL_MCAST_CAP_NET_ADMIN, so the kernel performed no privilege check on senders or subscribers. The root-cause class is missing authorization (CWE-862) leading to sensitive information exposure (CWE-200/CWE-522: cleartext credential exposure), even though NVD lists CWE as N/A. The CPE cpe:2.3:a:linux:linux:*:* identifies the mainline/stable Linux kernel; the SWN witness feature was introduced around kernel 5.11, which bounds the affected range.

RemediationAI

Vendor-released patch: upgrade to a fixed kernel - 5.15.210, 6.1.176, 6.6.143, 6.12.92, 7.0.11, 6.18.34, or mainline 7.1 or later, matching your maintained branch; apply your distribution's corresponding kernel update. The fix adds GENL_ADMIN_PERM to CIFS_GENL_CMD_SWN_NOTIFY and GENL_MCAST_CAP_NET_ADMIN to the SWN multicast group, so CAP_NET_ADMIN is required to send notifications or join the group. If immediate patching is not possible, reduce exposure by not using the SMB witness feature (avoid mounting shares with the witness/SWN protocol and do not run the cifs.witness helper), preferring Kerberos over NTLM for CIFS mounts so no cleartext password is placed in the netlink Register message, and restricting untrusted local user accounts on hosts that perform authenticated CIFS mounts; note these controls disable witness-based transparent failover functionality. Track the fix via the kernel.org stable commits (https://git.kernel.org/stable/c/a3238b09c58f323e40743ce174cd0ab81b5c09ed).

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64137 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy