- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,423
It is enough for the attacker to replace one file for a complete interception of the machine control.
Linux found a vulnerability that shows how a thin error at the junction and system utilities can turn into full control over the machine. The problem was called CIFSwitch, and the chain was helped by language models, which were given a tool for working with a graph of connections between objects, checks and privileged processes.
The author of the study reported a local vulnerability to increasing privileges in Linux. The error does not affect all systems, but only individual distributions and configurations, where several conditions coincide. The CVE identifier has not yet been assigned to the problem, but the fix is over a week available and added to the queue for stable kernel branches. Public disclosure was agreed with linux-distros@ after the embargo until May 27, 2026.
CIFSwitch is associated with the CIFS mechanism, which Linux uses SMB to work with network file resources. With Kerberos authentication, the kernel does not perform all the work independently, and through the Linux keyrings mechanism requests a cifs.spnego key. After such a request, the standard request-key rule starts ciphs.upcalll with root rights to prepare Kerberos/SPNEGO data.
The vulnerability occurred due to the fact that the kernel before the correction did not check the origin of the description of the key cifs.spnego. The usual unprivileged process could directly trigger a request_key() with a fake description, and the system ran an assistant cifs.upcalll with root rights in the same way as in a normal request from CIFR. The description could be substituted, uid, creduid and upball_target, affecting the choice of accounting and namespace.
The critical part of the chain was built around upscale_target=app. Assistant ciphs.upcall took a fake pid for data from the kernel and passed into the scope of the name of the process indicated by the attacker. Then, even before the fnal reset of the privileges, the account search was performed through the NSS.
In the controlled naming space, an attacker could replace nsswitch.conf and force the process with root rights to download its own module libns_*.so.2. In the demo code, such a download was used to record the rule in sudoers.d.
Vulnerable systems with a problematic version of the core installed by the cifs-utils package with the cifs.spnego rule, allowed to create unprivileged user namespaces and mount namespaces, as well as SELinux or AppArmor politicians that do not block the chain. According to the author, the error in the kernel has existed since 2007, and for cifs-utils versions 6.14 and above are most often dangerous, although some transfers of corrections could affect older builds.
To protect, administrators can set the corrected kernel, disable the CIFS module, delete cifs-utils if the package is not needed, replace the request-key rule for cifs.spnego with safe or prohibit unprivileged user namespaces. The author also published a demo code with which you can test whether a particular system is closed from the attack.
Linux found a vulnerability that shows how a thin error at the junction and system utilities can turn into full control over the machine. The problem was called CIFSwitch, and the chain was helped by language models, which were given a tool for working with a graph of connections between objects, checks and privileged processes.
The author of the study reported a local vulnerability to increasing privileges in Linux. The error does not affect all systems, but only individual distributions and configurations, where several conditions coincide. The CVE identifier has not yet been assigned to the problem, but the fix is over a week available and added to the queue for stable kernel branches. Public disclosure was agreed with linux-distros@ after the embargo until May 27, 2026.
CIFSwitch is associated with the CIFS mechanism, which Linux uses SMB to work with network file resources. With Kerberos authentication, the kernel does not perform all the work independently, and through the Linux keyrings mechanism requests a cifs.spnego key. After such a request, the standard request-key rule starts ciphs.upcalll with root rights to prepare Kerberos/SPNEGO data.
The vulnerability occurred due to the fact that the kernel before the correction did not check the origin of the description of the key cifs.spnego. The usual unprivileged process could directly trigger a request_key() with a fake description, and the system ran an assistant cifs.upcalll with root rights in the same way as in a normal request from CIFR. The description could be substituted, uid, creduid and upball_target, affecting the choice of accounting and namespace.
The critical part of the chain was built around upscale_target=app. Assistant ciphs.upcall took a fake pid for data from the kernel and passed into the scope of the name of the process indicated by the attacker. Then, even before the fnal reset of the privileges, the account search was performed through the NSS.
In the controlled naming space, an attacker could replace nsswitch.conf and force the process with root rights to download its own module libns_*.so.2. In the demo code, such a download was used to record the rule in sudoers.d.
Vulnerable systems with a problematic version of the core installed by the cifs-utils package with the cifs.spnego rule, allowed to create unprivileged user namespaces and mount namespaces, as well as SELinux or AppArmor politicians that do not block the chain. According to the author, the error in the kernel has existed since 2007, and for cifs-utils versions 6.14 and above are most often dangerous, although some transfers of corrections could affect older builds.
To protect, administrators can set the corrected kernel, disable the CIFS module, delete cifs-utils if the package is not needed, replace the request-key rule for cifs.spnego with safe or prohibit unprivileged user namespaces. The author also published a demo code with which you can test whether a particular system is closed from the attack.
