CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions

Synopsis

This is a privilege escalation vulnerability in the Linux kernel's SMB (CIFS) client. A local attacker with a low-privilege account can exploit it by injecting malicious cifs.spnego key descriptions via the userspace request_key(2) or add_key(2) syscalls, supplying authority-bearing fields (pid, uid, creduid, upcall_target) that the kernel's cifs.upcall treats as trusted kernel-originating inputs. Successful exploitation gives the attacker full read, write, and crash capability over the affected system. Patched-image rebuilds at the identified fix commits and version 5.10.258 are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative rights are needed to call request_key(2) or add_key(2).

• Victim interactionNot required

  The exploit executes without requiring any action from another user or an administrator.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or specific memory layout requirements must be satisfied.

Blast Radius

• Reads sensitive credential material, including uid, pid, and authentication tokens stored in CIFS spnego keys.
• Modifies authority-bearing key fields that the kernel trusts as kernel-originating, enabling credential substitution or privilege escalation.
• Crashes or destabilizes the affected host through kernel-level memory or state corruption reachable via the injected key data.
• Compromises the confidentiality, integrity, and availability of any filesystems mounted over SMB/CIFS on the affected host.