New CIFSwitch Linux flaw gives root on multiple distributions
A newly discovered vulnerability, dubbed 'CIFSwitch,' in the Linux kernel allows attackers to escalate privileges to root by forging CIFS authentication key descriptions. The flaw, present since 2007, affects multiple Linux distributions using vulnerable versions of the kernel and cifs-utils, particularly those utilizing Kerberos authentication. While exploitation depends on specific configurations and software versions, the vulnerability highlights a long-standing issue and underscores the importance of timely patching and security configurations.
The 'CIFSwitch' vulnerability (CVE-2026-46243) originates from a flaw in the Linux kernel's CIFS subsystem. Specifically, the kernel fails to properly validate the source of cifs.spnego key requests, allowing an unprivileged user to create a forged request and trigger the authentication workflow. This enables an attacker to trust attacker-controlled fields, leading to a namespace switch and subsequent Name Service Switch (NSS) lookup, ultimately resulting in root code execution. The vulnerability was introduced in 2007 and has persisted across numerous kernel and cifs-utils versions.
Several Linux distributions are affected, including Linux Mint, CentOS Stream, Rocky Linux, AlmaLinux, Kali Linux, and SLES. The impact is dependent on factors such as the kernel version, the presence of user namespaces, and the configuration of SELinux/AppArmor policies. While some distributions, like Ubuntu, Fedora, and Amazon Linux, are protected by default configurations, others require specific mitigations such as disabling the CIFS module or removing the cifs-utils package. The researcher, Asim Viladi Oglu Manizada, has released a proof-of-concept exploit to aid in validation and testing of patches.
This vulnerability joins a series of similar privilege escalation flaws affecting Linux systems, including 'Copy Fail,' 'Dirty Frag,' and 'PinTheft.' The discovery emphasizes the ongoing need for vigilance and proactive security measures within Linux environments.