CVE-2026-46243Disclosure(linux / linux_kernel)

LPE in the Linux kernel's CIFS client implementation CVE: CVE-2026-46243 PT ID: PT-2026-45478 Vendor: Linux Product: Linux CVSS: 7.8 Credits: Asim Viladi Oglu Manizada Description: A privilege escalation vulnerability was found in the Linux kernel's CIFS client implementation. This could allow a local attacker to impersonate other users, bypass authentication in SMB mount operations, and potentially gain unauthorized access to network file shares or escalate privileges. References: • https://dbugs.ptsecurity.com/vulnerability/CVE-2026-46243 • https://git.kernel.org/stable/c/7713bd320ed4fc3d08a227cd8e41242219a16981 PoC/Exploit: • https://github.com/manizada/CIFSwitch/ • https://heyitsas.im/posts/cifswitch/ #dbugs_vuln

Uma falha de quase 20 anos foi encontrada no kernel Linux. A CIFSwitch (CVE-2026-46243) permite que qualquer usuário local vire root sem permissão nenhuma. O bug está no protocolo CIFS desde 2007 e foi descoberto agora por um engenheiro de segurança da SpaceX. Mint, Kali, CentOS, Rocky e AlmaLinux estão entre os afetados.

CIFSwitch (CVE-2026-46243) patched kernels are now in production for AlmaLinux 8, 9, and 10—verified by our community before release. https://almalinux.org/blog/2026-05-28-cifswitch/?utm_medium=social&utm_source=twitter

🧵 Un investigador armat amb un framework d'IA ha descobert una vulnerabilitat crítica al kernel Linux que permet escalar a root. El codi vulnerable portava 19 anys amagat. El bug: CVE-2026-46243, "CIFSwitch" https://heyitsas.im/posts/cifswitch/

Patched kernels for CIFSwitch (CVE-2026-46243) have been released to the production repositories/mirrors. Thank you to everyone who helped verify these builds! Learn more ⤵️ https://almalinux.org/blog/2026-05-28-cifswitch/?utm_medium=social&utm_source=twitter

GitHub - MrForkBomb/CIFSwitch-Checker-CVE-2026-46243: Script para comprobar si la vulnerabilidad de Linux CIFSwitch (CVE-2026-46243) nos afecta. Detecta configuraciones potencialmente vulnerables y mitigaciones sin ejecutar exploits. · GitHub https://github.com/MrForkBomb/CIFSwitch-Checker-CVE-2026-46243

Une faille kernel de plus non corrigée, cette fois si c'est via CIFS/SMB, elle porte la référence CVE-2026-46243 et a une note de 7.8. Pas de panique, il faut avoir la bonne version de cifs-utils pour l'utiliser. https://next.ink/240221/cifswitch-nouvelle-faille-delevation-de-privileges-dans-linux/

🚨 Linux kernel tarafında güvenlik açıkları sessiz sedasız patchlenmeye devam ediyor. Şu an örneğin Rhel 8 / Almalinux 8'de en güncel kernel sürümü 4.18.0-553.129.1.el8_10 şeklinde. Patch CVE-2026-46243 kapsıyor. Eski sürüm kerneldeyseniz mutlaka güncelleyin.

CVE-2026-46243: CIFSwitch exploit enables unprivileged users to gain root access on Linux systems through forged CIFS SPNEGO upcalls. Affects wide range of distributions including Ubuntu, Debian, SUSE, and enterprise distros. Technical details: • Exploitation requires cifs-utils installed + CIFS kernel module loadable + unprivileged namespaces enabled • Attacker calls request_key("cifs.spnego",...) with forged description containing malicious pid/uid/creduid fields • cifs.upcall runs as root, trusts attacker-supplied data, switches into malicious mount namespace • Private namespace with controlled /etc/nsswitch.conf and libnss_*.so.2 achieves root code execution Attack chain: • User creates private mount namespace with weaponized NSS configuration files • Triggers request_key() with forged SPNEGO description pointing to malicious namespace • Root helper cifs.upcall performs NSS lookup in attacker-controlled environment • Malicious shared libraries execute with root privileges before privilege drop DFIR artifacts: • Monitor for unusual request_key syscalls with "cifs.spnego" type from unprivileged processes • Check /proc/*/ns/mnt for suspicious private mount namespaces • Audit /etc/nsswitch.conf modifications and non-standard libnss_*.so.2 libraries Immediate mitigations: Block CIFS module loading, override /etc/request-key.d/cifs.spnego.conf rule, or disable unprivileged namespaces. Kernel fix queued for stable releases. #DFIR_Radar

#Kernel_Security CIFSwitch: a non-universal Linux local root vulnerability https://heyitsas.im/posts/cifswitch // CIFSwitch (CVE-2026-46243) - distro-specific Linux LPE found by harnessing LLMs into better multihop knowledge composition #triage alerts simple http://www.cyberpocket.org/

Elastic Security Labs maps a durable, outcome-oriented Linux LPE detection framework against 11 public 2026 PoCs, covering page-cache corruption, namespace abuse, trusted-helper theft, and SUID misconfiguration without relying on per-CVE rules. Key findings: - Seven of 13 tracked 2026 Linux LPEs share a copy-on-write page-cache corruption primitive: Copy Fail (CVE-2026-31431), DirtyFrag (CVE-2026-43284/43500), Fragnesia (CVE-2026-46300), DirtyDecrypt (CVE-2026-31635), pedit COW (CVE-2026-46331), DirtyClone (CVE-2026-43503), and RefluXFS. The kernel trigger varies across AF_ALG, ESP/RxRPC, act_pedit, and skb helpers, but every exploit still ends the same way: a SUID helper or interpreter runs with effective uid 0. Qualys and others used LLM-assisted workflows to discover several of these, accelerating the per-bug-class pace. - The framework detects in two layers. Layer one is outcome-oriented: exec from a writable path (/tmp, /dev/shm, /var/tmp, /home, /run/user) followed by a uid_change to 0, correlated by parent entity ID within a short window. Layer two adds per-class signals: AF_ALG socket bursts plus splice for Copy Fail; unshare(CLONE_NEWUSER) preceding a root transition for CIFSwitch (CVE-2026-46243) and OVSwrap (CVE-2026-64531); busctl --system calls for ptrace_may_dream; and shadow-read alerts for chage_pwn (CVE-2026-46333). - CVE-2026-46333 (exit-time FD theft via pidfd_getfd) is worth special attention. #DFIR_Radar

Vendor v7.8. Source: X search for PoC exploit 2026 Posted: 2026-06-06T09:27:38.000Z Likes: 22 LPE in the Linux kernel's CIFS client implementation CVE: CVE-2026-46243 PT ID: PT-2026-45478 Vendor: Linux Product: Linux CVSS: 7.8 Credits: Asim Viladi Oglu Manizada…

CVE-2026-46243. Source: X search for PoC exploit 2026 Posted: 2026-06-06T09:27:38.000Z Likes: 22

Top 5 Trending CVEs: 1 - CVE-2018-17144 2 - CVE-2026-46243 3 - CVE-2026-49975 4 - CVE-2025-49113 5 - CVE-2026-28318 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard

CIFSwitch / CVE-2026-46243 is another Linux LPE to watch. Recent Linux LPEs like Copy Fail/DirtyFrag moved fast toward exploitability/in-the-wild use. No KEV yet, but this may be next. https://securityaffairs.com/192959/security/a-spacex-security-engineer-used-ai-to-find-a-19-year-old-linux-bug-that-gives-attackers-root.html

CVE-2026-46243 aneb CIFSwitch, lokální eskalace práv v Linuxu https://ift.tt/1fBnmG9

After analyzing 50% of vulnerabilities from past week, CVE-2026-46243 has 8 articles published from different internet sources, no other cve has these many articles. More information here: https://cves.st00ee.com/ #vulnerability #CyberSecurity #ThreatIntel #CVE #SecurityAlert

Greg Kroah-Hartman dropped a stack of stable kernels: 7.0.11, 6.18.34, 6.12.92, 6.6.142, 6.1.175, 5.15.209, 5.10.258. The headline fix is CVE-2026-46243, the "CIFSwitch" bug that opens a path to local root. Seven branches in one go. Which line are you tracking?

Asim Manizada disclosed CVE-2026-46243, a local-root bug in the Linux kernel's CIFS file-sharing client. It sat for years in the auth glue. The root bug was never in the fast-moving code. It was in the boring part each maintainer assumed another had read.