--- id: CVE-2026-46243 title: |- In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that … summary: |- In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that … severity: high cvss: 7.1 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N' cwe: - CWE-20 - CWE-825 vendor: linux product: linux_kernel affected: - 'linux_kernel >= 2.6.24.1, < 5.10.258' - 'linux_kernel >= 5.11, < 5.15.209' - 'linux_kernel >= 5.16, < 6.1.175' - 'linux_kernel >= 6.2, < 6.6.142' - 'linux_kernel >= 6.7, < 6.12.92' - 'linux_kernel >= 6.13, < 6.18.34' - 'linux_kernel >= 6.19, < 7.0.11' - linux_kernel = 2.6.24 - linux_kernel = 7.1 patched: - linux_kernel 7.0.11 published: '2026-06-01' updated: '2026-10-15' sourceUpdated: '2026-10-15T02:19:51.103' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-46243' references: - url: 'https://git.kernel.org/stable/c/0aece6685fc80a8de492688ca2315fb86ec379c7' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/2035acfb17221729b1b8ac335e941868a04ca079' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/3da1fdf4efbc490041eb4f836bf596201203f8f2' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/7713bd320ed4fc3d08a227cd8e41242219a16981' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/91f89c1d83e80417629791fcef6af8140d7d01c8' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/9544559e59438a4b609b2fdfa0763d8360572824' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/a3bbda6502a9398b816fa2e71c9a3f955f58013d' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/cf20038657d6d4974349556a34e08fe0490bebbc' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'http://www.openwall.com/lists/oss-security/2026/06/01/6' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2026:23258' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:23259' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:23329' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:23395' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:24381' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:25908' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:26462' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:26515' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:26535' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:26563' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:26570' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27708' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27719' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27729' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27735' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:28887' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:28962' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33219' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33220' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33221' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33222' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33223' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33224' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33225' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33486' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:34048' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:34757' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:34764' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:34788' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:34815' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:36620' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:40021' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:41236' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:47727' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-46243' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2481486' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://cert-portal.siemens.com/productcert/html/ssa-784472.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://github.com/manizada/CIFSwitch' label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46243.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/vulnerabilities/RHSB-2026-005' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-46243' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-46243' - url: >- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3da1fdf4efbc490041eb4f836bf596201203f8f2 - url: >- https://lore.kernel.org/linux-cve-announce/2026060140-CVE-2026-46243-3d1c@gregkh/ tags: - nvd - exploit-available - csaf - vex - red-hat - cve.org epss: 0.00413 epssPercentile: 0.35367 exploits: github: 5 githubRepos: - 'https://github.com/MrForkBomb/CIFSwitch-Checker-CVE-2026-46243' - 'https://github.com/suominen/cifswitch' - 'https://github.com/Koshmare-Blossom/CIFSwitch-go' checkedAt: '2026-10-27T19:00:46.779Z' exploitAvailable: true scores: nvd: 7.1 vendor: 7.8 cna: 7.1 ingestedAt: '2026-07-06T17:44:51.168Z' ssvc: exploitation: poc automatable: 'no' technicalImpact: total timestamp: '2026-06-01T00:00:00+00:00' --- ## Overview In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key. ## Affected - `linux_kernel >= 2.6.24.1, < 5.10.258` - `linux_kernel >= 5.11, < 5.15.209` - `linux_kernel >= 5.16, < 6.1.175` - `linux_kernel >= 6.2, < 6.6.142` - `linux_kernel >= 6.7, < 6.12.92` - `linux_kernel >= 6.13, < 6.18.34` - `linux_kernel >= 6.19, < 7.0.11` - `linux_kernel = 2.6.24` - `linux_kernel = 7.1` ## Remediation Upgrade past the affected range: - `linux_kernel 7.0.11` ## Vendor advisories - **RHSA-2026:23395** · Red Hat · fixed in: NVIDIA for RHEL 10 · released 2026-06-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:23395) - **RHSA-2026:33486** · Red Hat · fixed in: NVIDIA for RHEL 10 · released 2026-06-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:33486) - **RHSA-2026:27719** · Red Hat · fixed in: Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION), Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) · released 2026-06-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:27719) - **RHSA-2026:27729** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS) · released 2026-06-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:27729) - **RHSA-2026:41236** · Red Hat · fixed in: Red Hat Enterprise Linux for Real Time (v. 7 ELS) · released 2026-07-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:41236) - **RHSA-2026:34048** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:34048) - **RHSA-2026:40021** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2026-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:40021) - **RHSA-2026:28887** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:28887) - **RHSA-2026:28962** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.15 · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:28962) - **RHSA-2026:36620** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:36620) - **RHSA-2026:47727** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.17 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:47727)