CVE-2026-46243highCWE-20 CWE-825

smb: client: reject userspace cifs.spnego descriptions

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 7.1epss 0.4%

from disclosure to weapon0 days

Published on NVDJun 1

1st PoCMay 30

exploitation probability

0.4%top 69% of all CVEs

observed exploitation

nono source reports it

6 public exploit(s)

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

Linux · Linux

public PoCs found — 6

githubgithub.com/Koshmare-Blossom/CIFSwitch-go★ 2 githubgithub.com/MrForkBomb/CIFSwitch-Checker-CVE-2026-46243★ 2 githubgithub.com/liamromanis101/cifswitch-check★ 0 githubgithub.com/0xBlackash/CVE-2026-46243★ 0 githubgithub.com/suominen/cifswitch★ 0 cve_referencegithub.com/manizada/CIFSwitchunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References