CVE-2026-104715: cifs-utils Privilege Escalation Vulnerability

CVE-2026-104715 Overview

CVE-2026-104715 is a local privilege escalation flaw in cifs-utils, the userspace utilities for mounting Common Internet File System (CIFS) shares on Linux. The vulnerability occurs when a privileged service mounts a CIFS share using a user-controlled credentials file. Input values are not sanitized before being assembled into mount options, enabling argument injection classified as [CWE-88]. An unprivileged local attacker can inject unauthorized mount options to bypass permission checks and execute files with root privileges.

Critical Impact
A local, low-privileged user can escalate to root by poisoning credentials file inputs consumed by a privileged CIFS mount operation.

Affected Products

cifs-utils package on Linux distributions
Red Hat Enterprise Linux (per Red Hat advisory)
Any system where a privileged service invokes mount.cifs with user-supplied credentials files

Discovery Timeline

2026-10-16 - CVE-2026-104715 published to the National Vulnerability Database
2026-10-21 - Last updated in the NVD database

Technical Details for CVE-2026-104715

Vulnerability Analysis

The flaw resides in how cifs-utils parses credentials files passed to the mount.cifs helper. Fields read from these files flow into the mount option string without validation or escaping of delimiter characters. When a privileged daemon mounts a share on behalf of a user and consumes a credentials file the user controls, injected tokens become additional mount options. The result is a classic argument injection condition where attacker-supplied data crosses the boundary between data and command options. Because the mount runs with elevated privileges, injected options such as uid=0, setuids, or exec enable root-equivalent file execution.

Root Cause

The root cause is improper neutralization of argument delimiters in a command, tracked as [CWE-88]. The credentials file parser treats user-supplied values as trusted strings and concatenates them into the final mount option list without quoting or filtering of commas, equals signs, or whitespace that mount.cifs interprets as option separators.

Attack Vector

Exploitation requires local access and low privileges. The attacker must influence the contents of a credentials file that a privileged service references during a CIFS mount. By embedding crafted option fragments inside credential field values, the attacker causes mount.cifs to apply attacker-chosen mount options. Mount options that control ownership mapping, SUID handling, or executable flags enable the attacker to stage and run binaries with root privileges. No user interaction is required beyond triggering the privileged mount workflow.

No verified public proof-of-concept code is available at this time. Technical details are described in the Red Hat CVE-2026-104715 Advisory and discussed on the Openwall OSS Security list.

Detection Methods for CVE-2026-104715

Indicators of Compromise

Unexpected invocations of /sbin/mount.cifs or /usr/bin/mount.cifs from privileged services with user-writable credentials file paths.
CIFS mounts in /proc/mounts showing abnormal options such as uid=0, gid=0, suid, or exec on user-initiated shares.
Credentials files under user-controlled directories containing commas, newlines, or = characters inside field values.
Root-owned SUID binaries created on CIFS-mounted paths shortly after a mount event.

Detection Strategies

Audit execve events for mount.cifs invocations and inspect the full argument vector for injected option tokens.
Enable the Linux audit subsystem (auditd) rules on mount, mount.cifs, and credentials file reads performed by privileged UIDs.
Correlate privileged mount calls with the ownership and permissions of the referenced credentials file to flag user-writable sources.

Monitoring Recommendations

Alert on new SUID or SGID files appearing on filesystems mounted via CIFS by non-root users.
Monitor for mount.cifs child processes spawned by services that typically do not perform mounts.
Track changes to any credentials files referenced by systemd units, automount maps, or scheduled tasks.

How to Mitigate CVE-2026-104715

Immediate Actions Required

Apply vendor updates for cifs-utils as soon as distribution packages are available. Track status via the Red Hat CVE-2026-104715 Advisory.
Audit all privileged services, scripts, and systemd units that mount CIFS shares using credentials files sourced from user-writable paths.
Relocate credentials files to root-owned directories with mode 0600 and restrict write access to privileged accounts only.

Patch Information

Red Hat has published tracking for this issue in Red Hat Bugzilla Report #2545023. Install the fixed cifs-utils package from your Linux distribution once released. Verify the installed version after patching and restart any long-running services that cached the vulnerable binary.

Workarounds

Avoid passing user-controlled credentials files to mount.cifs from privileged contexts; use static, root-owned credentials files instead.
Mount CIFS shares with the nosuid and noexec options to limit the impact of injected options that enable executable or SUID behavior.
Remove the SUID bit from mount.cifs where interactive user mounts are not required: chmod u-s /sbin/mount.cifs.
Enforce SELinux or AppArmor policies that constrain which processes may invoke mount.cifs and which paths they may read as credentials files.

bash

# Configuration example: harden a credentials file used by a privileged mount
sudo install -o root -g root -m 0600 /dev/null /etc/cifs-credentials
sudo tee /etc/cifs-credentials > /dev/null <<'EOF'
username=svcuser
password=REPLACE_ME
domain=CORP
EOF

# Mount with hardening flags that limit the blast radius of option injection
sudo mount -t cifs //server/share /mnt/share \
  -o credentials=/etc/cifs-credentials,nosuid,noexec,nodev,uid=1000,gid=1000