--- id: CVE-2026-46243 title: |- In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that … summary: |- In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that … severity: high cvss: 7.1 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N' cwe: - CWE-20 - CWE-825 vendor: linux product: linux_kernel affected: - 'linux_kernel >= 2.6.24.1, < 5.10.258' - 'linux_kernel >= 5.11, < 5.15.209' - 'linux_kernel >= 5.16, < 6.1.175' - 'linux_kernel >= 6.2, < 6.6.142' - 'linux_kernel >= 6.7, < 6.12.92' - 'linux_kernel >= 6.13, < 6.18.34' - 'linux_kernel >= 6.19, < 7.0.11' - linux_kernel = 2.6.24 - linux_kernel = 7.1 patched: - linux_kernel 7.0.11 published: '2026-06-01' updated: '2026-07-06' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-46243' references: - url: 'https://git.kernel.org/stable/c/0aece6685fc80a8de492688ca2315fb86ec379c7' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/2035acfb17221729b1b8ac335e941868a04ca079' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/3da1fdf4efbc490041eb4f836bf596201203f8f2' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/7713bd320ed4fc3d08a227cd8e41242219a16981' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/91f89c1d83e80417629791fcef6af8140d7d01c8' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/9544559e59438a4b609b2fdfa0763d8360572824' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/a3bbda6502a9398b816fa2e71c9a3f955f58013d' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/cf20038657d6d4974349556a34e08fe0490bebbc' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'http://www.openwall.com/lists/oss-security/2026/06/01/6' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2026:23258' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:23259' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:23329' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:23395' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:24381' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:25908' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:26462' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:26515' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:26535' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:26563' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:26570' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27708' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27719' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27729' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27735' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:28887' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33219' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33220' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33221' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33222' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33223' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33224' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33225' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33486' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-46243' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2481486' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://github.com/manizada/CIFSwitch' label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46243.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c tags: - nvd - exploit-available epss: 0.00377 epssPercentile: 0.31599 ingestedAt: '2026-07-06T17:44:51.168Z' exploits: github: 4 githubRepos: - 'https://github.com/MrForkBomb/CIFSwitch-Checker-CVE-2026-46243' - 'https://github.com/suominen/cifswitch' - 'https://github.com/liamromanis101/cifswitch-check' checkedAt: '2026-09-24T07:53:04.294Z' exploitAvailable: true --- ## Overview In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key. ## Affected - `linux_kernel >= 2.6.24.1, < 5.10.258` - `linux_kernel >= 5.11, < 5.15.209` - `linux_kernel >= 5.16, < 6.1.175` - `linux_kernel >= 6.2, < 6.6.142` - `linux_kernel >= 6.7, < 6.12.92` - `linux_kernel >= 6.13, < 6.18.34` - `linux_kernel >= 6.19, < 7.0.11` - `linux_kernel = 2.6.24` - `linux_kernel = 7.1` ## Remediation Upgrade past the affected range: - `linux_kernel 7.0.11`