CVE-2026-64137: Linux Kernel Privilege Escalation Flaw

CVE-2026-64137 Overview

CVE-2026-64137 is a Linux kernel vulnerability in the SMB client's Server Witness Notification (SWN) generic-netlink interface. The CIFS_GENL_CMD_SWN_NOTIFY command lacked a capability flag, allowing any local process to send RESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness handler. The CIFS_GENL_MCGRP_SWN multicast group also lacked capability enforcement, letting unprivileged processes join the group and receive registration messages containing witness registration IDs and, for NTLM-authenticated mounts, usernames, domains, and passwords copied from CIFS sessions.

Critical Impact
Unprivileged local processes can inject spurious witness notifications into the CIFS client and harvest credential material from mounted NTLM sessions.

Affected Products

Linux kernel SMB client (fs/smb/client) with CIFS witness protocol support
Systems using cifs.witness userspace helper for SMB continuous availability
CIFS mounts authenticated with NTLM where session credentials are held in kernel memory

Discovery Timeline

2026-07-19 - CVE-2026-64137 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64137

Vulnerability Analysis

The Linux kernel exposes the CIFS witness protocol to userspace through a generic-netlink family. The intended sender is the privileged cifs.witness service, which relays SMB3 witness notifications for cluster failover events. The kernel handler processes commands such as CIFS_GENL_CMD_SWN_NOTIFY, which delivers RESOURCE_CHANGE and CLIENT_MOVE events that steer client behavior including reconnection and IP address migration.

The family definition omitted GENL_ADMIN_PERM on the notify operation and GENL_MCAST_CAP_NET_ADMIN on the multicast group. Without these flags, the netlink core does not enforce CAP_NET_ADMIN on incoming commands or on group membership requests. Any local process could therefore forge witness events or subscribe to the SWN multicast group.

The multicast payload is the higher-risk vector. Register messages sent by the kernel include the witness registration identifier plus NTLM username, domain, and password attributes drawn from the active CIFS session. Unprivileged listeners could passively harvest these credentials.

Root Cause

The root cause is missing access control on a privileged netlink interface, an instance of improper access control on a kernel API. The generic-netlink operation table for the CIFS family did not set capability flags, so the netlink subsystem accepted commands and multicast joins from any UID.

Attack Vector

Exploitation requires local code execution with the ability to open a NETLINK_GENERIC socket, which is available to unprivileged users by default. An attacker either sends a crafted CIFS_GENL_CMD_SWN_NOTIFY message to influence CIFS client state, or joins the CIFS_GENL_MCGRP_SWN multicast group and receives cleartext NTLM credential attributes broadcast by the kernel during witness registration. The vulnerability is exploitable without user interaction and impacts confidentiality, integrity, and availability of CIFS sessions.

Detection Methods for CVE-2026-64137

Indicators of Compromise

Unexpected processes other than cifs.witness opening NETLINK_GENERIC sockets and binding to the cifs family
Unprivileged UIDs issuing genlmsg traffic targeting the CIFS family or joining the CIFS_GENL_MCGRP_SWN multicast group
Anomalous CIFS reconnection or IP migration events without corresponding server-side witness activity

Detection Strategies

Audit socket() and bind() syscalls for AF_NETLINK with NETLINK_GENERIC originating from non-root processes and correlate with subsequent CIFS session state changes
Use eBPF or auditd rules to log sendmsg calls carrying CIFS_GENL_CMD_SWN_NOTIFY command identifiers to the generic-netlink family
Inventory kernel versions across the fleet and flag hosts running unpatched builds that also mount CIFS shares with NTLM authentication

Monitoring Recommendations

Alert on CIFS mount reconnection storms or unexpected CLIENT_MOVE transitions in kernel logs from dmesg and /var/log/messages
Monitor process execution baselines to ensure only cifs.witness interacts with the CIFS generic-netlink family
Track kernel package versions through configuration management and validate that patched commits are present on all Linux endpoints and servers

How to Mitigate CVE-2026-64137

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits listed below and reboot affected hosts
Prefer Kerberos (sec=krb5) over NTLM for CIFS mounts to prevent password material from being stored in the session structure that feeds SWN register messages
Restrict local shell and code execution on hosts that mount CIFS shares, since exploitation requires local access

Patch Information

The fix requires CAP_NET_ADMIN for incoming SWN_NOTIFY commands by setting GENL_ADMIN_PERM, and requires CAP_NET_ADMIN over the network namespace for joining the SWN multicast group via GENL_MCAST_CAP_NET_ADMIN. Stable kernel commits include 969bc63, 9919021, 9cf7eb8, a3238b0, a8d17d2, c2397b9, and d1ebfce.

Workarounds

Unload the cifs kernel module on systems that do not require SMB client functionality using modprobe -r cifs and blacklist it in /etc/modprobe.d/
Disable the witness protocol by unmounting CIFS shares that rely on it and remounting without continuous availability options until patches are applied
Constrain access to NETLINK_GENERIC via seccomp profiles or user namespace restrictions on multi-tenant systems

bash

# Verify running kernel includes the CIFS SWN capability fix
uname -r
# Blacklist the CIFS module on hosts that do not need SMB client
echo 'blacklist cifs' | sudo tee /etc/modprobe.d/disable-cifs.conf
sudo modprobe -r cifs
# Prefer Kerberos over NTLM in /etc/fstab for CIFS mounts
# //server/share /mnt/share cifs sec=krb5,cruid=user,_netdev 0 0