CVE-2026-104715

A local privilege-escalation flaw in cifs-utils lets an unprivileged user gain root when a privileged service mounts a CIFS share using a credentials file that the attacker can influence. Values from that file are not properly sanitized before they are assembled into mount options, so an attacker can inject extra mount options (CWE-88). Injected options can bypass permission checks and cause files to run with administrative privileges. The issue affects systems that use cifs-utils in that privileged, user-controlled credentials-file pattern; affected version ranges are not stated in the advisory data. A public proof-of-concept reference exists, and the flaw is not listed in CISA KEV, so exploitation is known as PoC-public rather than confirmed in the wild.

What to do: Apply the cifs-utils update from your distribution as soon as a patched package is available, and treat any privileged CIFS mount that reads a user-writable credentials file as high priority. Until then, do not let unprivileged users supply or edit credentials files or mount options used by root or other privileged mount helpers; lock down file permissions and review systemd mount units, automount, and scripts that call mount.cifs. After patching, confirm the package version from the vendor advisory and recheck those mount configurations.