PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46243 Linux CVE debrief

A local privilege escalation vulnerability in the Linux kernel's SMB client (CIFS) subsystem allows unprivileged users to forge cifs.spnego key descriptions, potentially leading to authentication bypass or elevated privileges. The flaw exists because userspace processes could create cifs.spnego keys via request_key(2) or add_key(2) with attacker-controlled authority-bearing fields (pid, uid, creduid, upcall_target) that cifs.upcall incorrectly treated as kernel-originating inputs. The fix restricts acceptance of cifs.spnego descriptions to only those requested while CIFS is using its private spnego_cred, preventing userspace from injecting malicious key descriptions.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-08-07
Advisory published
2026-06-01
Advisory updated
2026-08-07

Who should care

Linux system administrators, kernel maintainers, and security teams operating environments with CIFS/SMB mounts. Organizations relying on multi-user Linux systems with SMB file shares face elevated risk from local attackers seeking privilege escalation.

Technical summary

The Linux kernel's CIFS/SMB client uses cifs.spnego keys for SPNEGO authentication handling. These key descriptions contain security-relevant fields including pid, uid, creduid, and upcall_target. The cifs.upcall helper processes these fields as trusted kernel-originating inputs. However, because userspace could independently create keys of type cifs.spnego through standard key management syscalls (request_key(2), add_key(2)), an attacker with local access could supply crafted values for these authority-bearing fields without legitimate CIFS origin. The vulnerability is resolved by restricting acceptance of cifs.spnego key descriptions to only those requested while the CIFS subsystem is actively using its private spnego_cred structure, ensuring kernel-controlled provenance for these sensitive fields.

Defensive priority

HIGH

Recommended defensive actions

  • Apply kernel stable patches from the Linux kernel stable tree when available for your distribution
  • Restrict unprivileged access to keyctl operations where possible via security policies
  • Monitor for anomalous key creation events related to cifs.spnego type keys
  • Update to a patched kernel version containing the fix for CVE-2026-46243

Evidence notes

Official kernel stable commits resolve the issue. CVSS 7.8 (HIGH) per NVD with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46243 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46243

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46243 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46243

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0aece6685fc80a8de492688ca2315fb86ec379c7

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2035acfb17221729b1b8ac335e941868a04ca079

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3da1fdf4efbc490041eb4f836bf596201203f8f2

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7713bd320ed4fc3d08a227cd8e41242219a16981

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/91f89c1d83e80417629791fcef6af8140d7d01c8

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9544559e59438a4b609b2fdfa0763d8360572824

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a3bbda6502a9398b816fa2e71c9a3f955f58013d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.