CVE-2026-46243
HIGHsmb: client: reject userspace cifs.spnego descriptions
Title source: cnaExploitation Summary
EIP tracks 4 public exploits for CVE-2026-46243. PoCs published by Unclecheng-li, Koshmare-Blossom, liamromanis101.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-46243, a local privilege escalation vulnerability in the Linux Kernel CIFS component. The exploit leverages a missing source validation in `cifs.spnego` key descriptions to manipulate `cifs.upcall` into loading a malicious NSS library, thereby granting root access via sudoers manipulation.
Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key.
Exploits (4)
This repository contains a functional exploit for CVE-2026-46243, a local privilege escalation vulnerability in the Linux Kernel CIFS component. The exploit leverages a missing source validation in `cifs.spnego` key descriptions to manipulate `cifs.upcall` into loading a malicious NSS library, thereby granting root access via sudoers manipulation.
This repository contains a functional Go-based exploit for CVE-2026-46243, leveraging a namespace confusion vulnerability in the Linux kernel's handling of CIFS key requests. The exploit forges a cifs.spnego key description to trick cifs.upcall into loading a malicious NSS library, achieving local privilege escalation (LPE).
This repository contains a shell script that checks for exposure to CVE-2026-46243, a local privilege escalation vulnerability in the Linux kernel's CIFS/SMB client. The script verifies kernel versions, cifs-utils installation, module status, user namespace settings, and other mitigations but does not include exploit code.
This repository contains a bash script that scans for the presence of components related to CVE-2026-46243 (CIFSwitch vulnerability) without exploiting it. It checks for cifs.upcall, request-key, CIFS module availability, user namespaces, and other system configurations to determine potential vulnerability.
References (10)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N