PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46243 Linux CVE debrief

A local privilege escalation vulnerability in the Linux kernel's SMB client (CIFS) subsystem allows unprivileged users to forge cifs.spnego key descriptions, potentially leading to authentication bypass or elevated privileges. The flaw exists because userspace processes could create cifs.spnego keys via request_key(2) or add_key(2) with attacker-controlled authority-bearing fields (pid, uid, creduid, upcall_target) that cifs.upcall incorrectly treated as kernel-originating inputs. The fix restricts acceptance of cifs.spnego descriptions to only those requested while CIFS is using its private spnego_cred, preventing userspace from injecting malicious key descriptions.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-06-01
Advisory published
2026-06-01
Advisory updated
2026-06-01

Who should care

Linux system administrators, kernel maintainers, and security teams operating environments with CIFS/SMB mounts. Organizations relying on multi-user Linux systems with SMB file shares face elevated risk from local attackers seeking privilege escalation.

Technical summary

The Linux kernel's CIFS/SMB client uses cifs.spnego keys for SPNEGO authentication handling. These key descriptions contain security-relevant fields including pid, uid, creduid, and upcall_target. The cifs.upcall helper processes these fields as trusted kernel-originating inputs. However, because userspace could independently create keys of type cifs.spnego through standard key management syscalls (request_key(2), add_key(2)), an attacker with local access could supply crafted values for these authority-bearing fields without legitimate CIFS origin. The vulnerability is resolved by restricting acceptance of cifs.spnego key descriptions to only those requested while the CIFS subsystem is actively using its private spnego_cred structure, ensuring kernel-controlled provenance for these sensitive fields.

Defensive priority

HIGH

Recommended defensive actions

  • Apply kernel stable patches from the Linux kernel stable tree when available for your distribution
  • Restrict unprivileged access to keyctl operations where possible via security policies
  • Monitor for anomalous key creation events related to cifs.spnego type keys
  • Update to a patched kernel version containing the fix for CVE-2026-46243

Evidence notes

Official kernel stable commits resolve the issue. CVSS 7.8 (HIGH) per NVD with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Official resources

Published 2026-06-01; kernel fix commits available same day. No known exploitation in the wild; not listed in CISA KEV.