Riskcovery

CVE-2026-46243

smb: client: reject userspace cifs.spnego descriptions

State
Published
Severity
7.1 High
Published
Jun 1, 2026
Updated
Oct 15, 2026
Reserved
May 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject userspace cifs.spnego descriptions

cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin.

Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key.

Scores

CVSSScoreVectorSource
3.17.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NLinux
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCISA-ADP
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hredhat-SADP

Weaknesses

  • CWE-20 Improper Input Validation
  • CWE-825 Expired Pointer Dereference

Affected Products

ProductVersions
LinuxLinux
  • f1d662a7d5e5322e583aad6b3cfec03d8f27b435 to before 7713bd320ed4fc3d08a227cd8e41242219a16981Affected
  • f1d662a7d5e5322e583aad6b3cfec03d8f27b435 to before 9544559e59438a4b609b2fdfa0763d8360572824Affected
  • f1d662a7d5e5322e583aad6b3cfec03d8f27b435 to before cf20038657d6d4974349556a34e08fe0490bebbcAffected
  • f1d662a7d5e5322e583aad6b3cfec03d8f27b435 to before 2035acfb17221729b1b8ac335e941868a04ca079Affected
  • f1d662a7d5e5322e583aad6b3cfec03d8f27b435 to before a3bbda6502a9398b816fa2e71c9a3f955f58013dAffected
  • f1d662a7d5e5322e583aad6b3cfec03d8f27b435 to before 91f89c1d83e80417629791fcef6af8140d7d01c8Affected
  • f1d662a7d5e5322e583aad6b3cfec03d8f27b435 to before 0aece6685fc80a8de492688ca2315fb86ec379c7Affected
  • f1d662a7d5e5322e583aad6b3cfec03d8f27b435 to before 3da1fdf4efbc490041eb4f836bf596201203f8f2Affected
LinuxLinux
  • 2.6.24Affected
  • before 2.6.24Not affected
  • 5.10.258 through 5.10.*Not affected
  • 5.15.209 through 5.15.*Not affected
  • 6.1.175 through 6.1.*Not affected
  • 6.6.142 through 6.6.*Not affected
  • 6.12.92 through 6.12.*Not affected
  • 6.18.34 through 6.18.*Not affected
  • 7.0.11 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.