New CIFSwitch Linux flaw gives root on multiple distributions
A Linux kernel flaw dubbed CIFSwitch can let local attackers gain root on several distributions. A patch exists, and mitigations include disabling CIFS and unprivileged user namespaces.
Intelligence analysis by GPT-5.4 Mini
Researchers say a Linux kernel CIFS bug can be abused to forge cifs.spnego key requests, trick the normal authentication path, and run code as root on affected systems. The issue depends on configuration, but it affects multiple distributions and has a kernel fix upstream.
A hidden doorway in Linux was found that can let a regular user become the boss of the computer. It happens when the system asks for help handling a file-sharing login, and a sneaky person can pretend to be that request.
Think of it like a restaurant that only lets the kitchen staff place food orders, but a customer finds a way to send an order ticket that looks official. The kitchen trusts it and starts cooking the wrong thing.
The good news is that a fix exists. People who protect computers should patch quickly and, if they do not need this file-sharing feature, turn it off so the doorway stays closed.
Analysis
What the flaw does
BleepingComputer reports a newly disclosed Linux local privilege escalation bug called CIFSwitch. The issue sits in the kernel's CIFS subsystem and can let an unprivileged user forge a cifs.spnego key request, then abuse the normal authentication workflow to reach root privileges.
Why it works
According to the researcher, the kernel fails to verify that the request really came from the CIFS client. That matters because the cifs.upcall helper runs as root and is expected to trust fields generated by the kernel. The report says an attacker can abuse those fields to force a namespace switch and trigger a Name Service Switch lookup before privileges are dropped, which can lead to malicious module loading and root code execution.
Impact and fixes
The flaw is described as non-universal: exploitation depends on the kernel version, the cifs-utils version, whether user namespaces are available, and whether SELinux or AppArmor stop the attack. The article lists Linux Mint 21.3/22.3, CentOS Stream 9, Rocky Linux 9, AlmaLinux 9, Kali Linux 2021.4–2026.1, and SLES 15 SP7 as vulnerable by default, while several newer releases are said to resist exploitation because of default SELinux/AppArmor policy. A kernel patch adding validation of cifs.spnego request origins has been merged upstream, and the researcher also recommends disabling CIFS if unused, removing cifs-utils if unnecessary, and turning off unprivileged user namespaces. A proof-of-concept exploit has also been published to help validate patches and mitigations.
Key points
- CIFSwitch is a Linux local privilege escalation flaw affecting the CIFS kernel path.
- Attackers can forge `cifs.spnego` requests and abuse the root-run `cifs.upcall` helper.
- Exploitation depends on kernel, `cifs-utils`, user namespaces, and MAC policies.
- A kernel patch is available upstream, and a proof-of-concept exploit has been published.
- Disabling CIFS or unprivileged user namespaces can reduce risk on affected systems.
