cifs-utils EUVD-2026-102803

Exploitation requires a specific deployment pattern: a privileged (root) service must mount a CIFS share using a credentials file whose contents are controlled or influenceable by the unprivileged attacker, and the attacker must be a local user on the host. The core enabling flaw is that input values from that credentials file are not sanitized before being assembled into mount options (CWE-88), permitting injection of unauthorized options. Limiting factors that reduce real-world exposure: the attack is local-only (AV:L) with no network reach, it requires the attacker to already hold a local low-privilege account (PR:L), and it is only exploitable where such a privileged, credentials-file-driven CIFS mount workflow actually exists - hosts with no service mounting attacker-influenced CIFS shares are not affected.

This is a credible local privilege escalation risk that warrants prioritized patching on affected hosts, though it is not an emergency internet-facing threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms it requires local access and some existing low privilege, but offers full triple-High impact (C:H/I:H/A:H) because successful exploitation yields root. No EPSS score, KEV listing, or public POC was provided in the input, so exploitation likelihood signals are absent rather than reassuring - per precision rules this means no public exploit is identified at time of analysis, not that risk is low. There is no conflict between the CVSS vector and the description: both consistently describe a local, low-privilege, high-impact escalation via CWE-88 argument/option injection. The main factor that moderates real-world risk is the required precondition - a privileged service must mount a CIFS share using a credentials file whose contents the attacker can influence - so this is an environment-dependent escalation rather than a universal local-root bug. Treat as a high-priority fix on RHEL/OpenShift systems that use automated or service-driven CIFS mounts.

A low-privileged local user on a RHEL or OpenShift host identifies a privileged service (e.g. a root-run automount or orchestration job) that mounts a CIFS share using a credentials file the user can write to or influence. The attacker inserts crafted values that are assembled unsanitized into the mount command line, injecting unauthorized mount options that bypass permission checks and cause files to execute with root privileges. No public exploit code was identified at time of analysis, and the local-only, low-complexity vector means exploitation is straightforward once the vulnerable mount workflow exists.