CVE-2026-104715
7.8HighPublished 16 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-88
Impact
A local unprivileged attacker can escalate privileges to root when a privileged service mounts a CIFS share using a user-controlled credentials file. They achieve this by injecting malicious mount options into the unsanitized credential parameters.
Root cause
Improper input sanitization of credential file values allows command/argument injection into CIFS mount options.
Affected systems
cifs-utils (versions not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade cifs-utils to the latest vendor-patched release once available; as an interim workaround, prevent unprivileged users from modifying or supplying credentials files used by privileged mount operations.
$ sudo apt-get update && sudo apt-get install --only-upgrade cifs-utils || sudo dnf upgrade cifs-utilsAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.