CVE-2026-64137
Received Received - Intake

Privilege Escalation in Linux Kernel SMB Client

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: require net admin for CIFS SWN netlink CIFS_GENL_CMD_SWN_NOTIFY is the userspace witness-notify command. The intended sender is the cifs.witness helper, but the generic-netlink operation currently has no capability flag, so any local process can send RESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness handler. The same family exposes CIFS_GENL_MCGRP_SWN without multicast-group capability flags. Register messages sent to that group include the witness registration id and, for NTLM-authenticated mounts, the username, domain, and password attributes copied from the CIFS session. An unprivileged local process should not be able to join that group and receive those messages. Require CAP_NET_ADMIN for incoming SWN_NOTIFY commands with GENL_ADMIN_PERM, and require CAP_NET_ADMIN over the network namespace for joining the SWN multicast group with GENL_MCAST_CAP_NET_ADMIN. The cifs.witness service runs with the privileges needed for both operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64137
EUVD
EUVD-2026-45822

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves the CIFS SWN netlink interface. It allows any local process to send unauthorized notifications to the kernel's witness handler without proper permissions. Additionally, sensitive authentication details like usernames, domains, and passwords could be exposed if an unprivileged process joins a multicast group.

Detection Guidance

This vulnerability involves improper access controls in the Linux kernel's CIFS SWN netlink operations. To detect it, check for unauthorized processes attempting to use CIFS_GENL_CMD_SWN_NOTIFY or join the CIFS_GENL_MCGRP_SWN multicast group. Monitor kernel logs for suspicious netlink activity or unauthorized witness registration attempts.

Impact Analysis

An attacker with local access could exploit this to send fake notifications to the kernel, potentially disrupting SMB/CIFS operations. If they join the multicast group, they might intercept sensitive credentials from NTLM-authenticated mounts, leading to unauthorized access or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of credentials or session data may result in non-compliance with data protection regulations.

Mitigation Strategies

Apply the latest Linux kernel security patches to resolve this issue. Ensure the cifs.witness service runs with appropriate privileges. Monitor for unauthorized netlink operations and restrict CAP_NET_ADMIN capabilities to trusted processes only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64137. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart