CVE-2026-46243: Linux Kernel CIFS Credential Forgery Vulnerability (CVSS 7.1)

Technical summary

The vulnerability resides in the Linux kernel's CIFS client implementation, specifically in how it validates cifs.spnego key descriptions used for Kerberos/SPNEGO authentication. cifs.spnego keys are designed to contain authority-bearing metadata fields (pid, uid, creduid, upcall_target) that the cifs.upcall daemon assumes originate from the kernel. However, the kernel did not properly gate key creation: userspace processes could invoke request_key(2) or add_key(2) system calls to create cifs.spnego keys with arbitrary field values, bypassing the intended kernel-only origin check. This allows crafting malicious spnego descriptions that cifs.upcall will process as trusted kernel requests. The remediation validates that cifs.spnego keys are only accepted when the requesting credential object matches the kernel's private spnego_cred structure, ensuring only legitimate kernel-originated requests are honored.

Business impact

For organizations relying on CIFS/SMB for file sharing, network authentication, or NAS access, this vulnerability enables local privilege escalation and credential theft. A compromised unprivileged account—or a malicious user with shell access—can forge authentication requests to the CIFS daemon, potentially obtaining credentials with higher privileges or intercepting authentication tokens destined for network resources. This is particularly dangerous in hybrid cloud environments, containerized deployments, or systems where local accounts are segregated from administrative access. Attackers could exfiltrate sensitive files, modify shared resources, or move laterally to network shares without administrative intervention. Patching is critical for systems where local and remote security boundaries must be strictly enforced.

Affected systems

All Linux kernel versions that include the vulnerable cifs.spnego key handling code are affected. This includes enterprise distributions (Red Hat Enterprise Linux, Ubuntu LTS, Debian, SUSE), mainstream kernels, and container images built on Linux. The vulnerability affects any system where: (1) the CIFS client is enabled (common in corporate environments with SMB/NFS shares); (2) local user accounts exist on the system; and (3) the kernel has not received a patched build. Systems using NFS exclusively, or with strict local access controls (single-user, appliance-mode), have lower practical exposure, but still require patching for defense-in-depth.

Exploitability

Exploitation requires local access (CWE-20: improper input validation; CWE-825: uncontrolled request for resource with arbitrary indices suggest kernel resource confusion). The attack is straightforward: call request_key(2) with a crafted cifs.spnego key description containing forged authority fields. No special privileges, kernel module loading, or kernel vulnerability chains are needed—a standard unprivileged user can trigger this. The technical barrier is low for anyone familiar with Linux keyring mechanisms. While this is not a remote vulnerability, its low local complexity and high impact (confidentiality and integrity of credentials and data) make it a priority for patching, especially on multi-tenant systems or shared infrastructure.

Remediation

Apply a kernel patch that restricts cifs.spnego key acceptance to requests originating from the kernel's private spnego_cred structure. This validation ensures userspace-supplied cifs.spnego descriptions are rejected, closing the forgery vector. Patched kernel versions should be verified against your Linux vendor's advisory for your specific distribution (Red Hat, Canonical, Debian, etc.) and architecture. Interim mitigations include disabling CIFS client functionality if not required, restricting local user accounts, or running CIFS operations in isolated containers with strict keyring access controls.

Patch guidance

Contact your Linux vendor (Red Hat, Canonical Ubuntu, Debian, SUSE, etc.) for patched kernel versions. Do not rely on a single upstream kernel version number; each distribution maintains its own patch cadence. Verify patched versions against the vendor's security advisory for CVE-2026-46243. Test patches in a staging environment before production rollout, as kernel updates require system restart. Prioritize systems with: (1) multiple local user accounts; (2) active CIFS mounts to sensitive network resources; (3) multi-tenant or shared compute environments. Consider scheduling updates during low-impact maintenance windows.

Detection guidance

Monitor audit logs for suspicious request_key(2) or add_key(2) syscalls targeting cifs.spnego keys from non-root or unexpected uid contexts. Watch for authentication anomalies in CIFS/SMB logs (unusual credential UID values, unexpected upcall targets). Host-based IDS rules can flag patterns like repeated failed cifs.spnego key creation attempts. Network-level detection is difficult since the attack is purely local, but lateral movement after credential theft may show up as unusual SMB share access from compromised accounts. Forensic inspection of /proc/keys or kernel keyring dumps post-compromise can reveal injected spnego keys.

Why prioritize this

This vulnerability ranks HIGH (CVSS 7.1) because it combines low attack complexity with high confidentiality and integrity impact. Attackers need only local access—a common scenario in cloud, container, and shared hosting—yet can compromise authentication credentials and sensitive file access. Unlike purely local DoS vulnerabilities, this enables lateral movement and data theft. It should be prioritized above local-only info-disclosure flaws and alongside remote code execution issues, especially for systems where the CIFS client is actively used or where local user isolation is imperfect.

Risk score, explained

CVSS 3.1 base score 7.1 (HIGH) reflects: AV:L (attack vector: local access required), AC:L (low complexity—standard syscalls), PR:L (requires unprivileged user privilege level—a low bar), UI:N (no user interaction), S:U (scope: unchanged), C:H (confidentiality: high—credential and data exposure), I:H (integrity: high—forged auth requests), A:N (availability: no direct impact). The score appropriately penalizes the local-only attack surface but rewards the severity of credential compromise. No CVSS score modifiers (environmental or temporal adjustments) are applied; organizations should adjust their internal risk rating based on CIFS usage prevalence and local access controls.

Frequently asked questions