Local Privilege Escalation Vulnerability in cifs-utils Package by Red Hat
CVE-2026-12505
7.8HIGH
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 18 June 2026
What is CVE-2026-12505?
A vulnerability exists in the cifs-utils package where the cifs.upcall helper does not securely drop its root privileges before accessing user information in a user-controlled environment. This flaw can be exploited by a low-privileged local attacker using a specially crafted request_key payload. The attacker can mislead the root-owned helper into entering a malicious namespace, leading to the execution of arbitrary commands with elevated privileges as the root user. As a result, this vulnerability poses a significant risk of complete system compromise.
Affected Version(s)
Red Hat Enterprise Linux 10 0:7.6-1.el10_2
Red Hat Enterprise Linux 8 0:7.0-5.el8_10
Red Hat Enterprise Linux 9 0:7.6-2.el9_8