Linux Kernel Vulnerability in cifs.spnego Key Descriptions

CVE-2026-46243

What is CVE-2026-46243?

A vulnerability exists in the Linux kernel related to cifs.spnego key descriptions. The issue arises from the way authority-bearing fields, such as pid, uid, and creduid, are treated by the cifs.upcall module. Userspace can create cifs.spnego keys using request_key(2) or add_key(2), which may lead to supplying these fields without proper validation of the CIFS origin. This vulnerability requires that cifs.spnego descriptions be accepted only when CIFS is using its private spnego_cred to request keys, ensuring better security measures are in place to avoid potential exploitation.

References