A newly discovered local privilege escalation vulnerability in the Linux kernel, dubbed 'CIFSwitch,' allows unprivileged users to gain root access by forging CIFS authentication key descriptions and exploiting the kernel's key request mechanism. The flaw affects systems using vulnerable combinations of the kernel CIFS module and cifs-utils version 6.14 or higher, though some older versions are also impacted.

CIFS (Common Internet File System) is a protocol that enables access to files and devices across a local network, and Linux uses it to mount and interact with remote systems. When a CIFS share uses Kerberos authentication, the kernel relies on a user-space helper program—part of the cifs-utils package—to perform authentication. The vulnerability arises because the kernel’s CIFS subsystem does not verify that cifs.spnego key requests originate from the kernel itself.

An attacker can exploit this by creating a forged cifs.spnego request, triggering the authentication workflow. This causes the root-privileged cifs.upcall helper to process attacker-controlled fields it assumes were generated by the kernel. By manipulating these fields to switch namespaces and initiating a Name Service Switch (NSS) lookup before privileges are dropped, a local user can load a malicious NSS module and execute code as root.

Asim Viladi Oglu Manizada, a SpaceX security engineer who discovered the vulnerability, explained, "The kernel requests a cifs.spnego-type key, and the normal keyutils/request-key config runs cifs.upcall as root to fetch or build the Kerberos/SPNEGO material." He noted the vulnerability is "non-universal" and depends on several conditions, including kernel and cifs-utils versions, availability of user namespaces, and permissive SELinux or AppArmor policies.

Confirmed vulnerable distributions with default configurations include Linux Mint 21.3 and 22.3, CentOS Stream 9, Rocky Linux 9, AlmaLinux 9, Kali Linux 2021.4–2026.1, and SLES 15 SP7. Some Ubuntu, Debian, Pop!_OS, openSUSE, Oracle Linux, and Amazon Linux versions may also be affected if cifs-utils is installed. However, Ubuntu 26.04, Fedora 40–44, CentOS Stream 10, Rocky Linux 10, SLES 16, AlmaLinux 10, and openSUSE Leap 16 ship with default security policies that block exploitation. Amazon Linux 2 and Kali Linux 2019.4 and 2020.4 are not affected because their cifs-utils versions lack the namespace-switch functionality.

The vulnerability, introduced in 2007, has been patched upstream with commit 3da1fdf, which adds validation of cifs.spnego request origins. Manizada recommends disabling the CIFS module if unused, removing cifs-utils when unnecessary, and disabling unprivileged user namespaces as mitigations. He has also published a proof-of-concept exploit to help validate patch effectiveness.