Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-46243

smb: client: reject userspace cifs.spnego descriptions

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • f1d662a7d5e5322e583aad6b3cfec03d8f27b435 to < 7713bd320ed4fc3d08a227cd8e41242219a16981affected
  • f1d662a7d5e5322e583aad6b3cfec03d8f27b435 to < 9544559e59438a4b609b2fdfa0763d8360572824affected
  • f1d662a7d5e5322e583aad6b3cfec03d8f27b435 to < cf20038657d6d4974349556a34e08fe0490bebbcaffected
  • f1d662a7d5e5322e583aad6b3cfec03d8f27b435 to < 2035acfb17221729b1b8ac335e941868a04ca079affected
  • f1d662a7d5e5322e583aad6b3cfec03d8f27b435 to < a3bbda6502a9398b816fa2e71c9a3f955f58013daffected
  • f1d662a7d5e5322e583aad6b3cfec03d8f27b435 to < 91f89c1d83e80417629791fcef6af8140d7d01c8affected
  • f1d662a7d5e5322e583aad6b3cfec03d8f27b435 to < 0aece6685fc80a8de492688ca2315fb86ec379c7affected
  • f1d662a7d5e5322e583aad6b3cfec03d8f27b435 to < 3da1fdf4efbc490041eb4f836bf596201203f8f2affected

Linux Linux

Default version status: affected

  • 2.6.24affected
  • 0 to < 2.6.24unaffected
  • 5.10.258 to ≤ 5.10.*unaffected
  • 5.15.209 to ≤ 5.15.*unaffected
  • 6.1.175 to ≤ 6.1.*unaffected
  • 6.6.142 to ≤ 6.6.*unaffected
  • 6.12.92 to ≤ 6.12.*unaffected
  • 6.18.34 to ≤ 6.18.*unaffected
  • 7.0.11 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References