cifs-utils: Mount option injection in mount.cifs allows local privilege escalation

Summary

cifs-utils, the Linux tools for mounting SMB/CIFS shares, does not properly sanitise values in the credentials file path when a privileged service mounts a share with a user-controlled credentials file. A local user with low privileges can inject unauthorised mount options, bypass permission checks and execute files with root privileges. Exploitation requires a non-standard setup in which a privileged process, such as an automount helper or pam_mount, uses credentials files in user-writable locations.

Affected

• Red Hat Enterprise Linux 7, 8, 9 and 10 (affected per Red Hat; RHEL 6 status unknown)
• Red Hat OpenShift Container Platform 4 and 5 (affected per Red Hat)
• Ubuntu 22.04, 24.04 and 26.04 LTS and 26.10 before the fixed versions listed below
• SUSE Linux Micro and SLES 12 before the fixed versions listed below
• Debian, Fedora and Amazon Linux: tracked as affected, fixed versions not verified
• Vulnerable version range, per a third-party PoC write-up (unverified): cifs-utils 7.0 through 7.6, possibly older

Fixed in

• Ubuntu 26.10: 2:7.4-1ubuntu3.1
• Ubuntu 26.04 LTS: 2:7.4-1ubuntu0.26.04.4
• Ubuntu 24.04 LTS: 2:7.0-2ubuntu0.6
• Ubuntu 22.04 LTS: 2:6.14-1ubuntu0.7
• SUSE Linux Micro 6.0: cifs-utils-7.0-159998.1.1 (advisory SUSE-SLE-Micro-6.0-947)
• SUSE Linux Micro 6.2 and SLES 12: see SUSE advisories SUSE-SU-2026:4897-1 and the SUSE Micro 6.2 advisory
• Red Hat, Debian, Fedora and Amazon Linux: fixed package versions unknown, check the vendor advisories
• Upstream: reportedly fixed in cifs-utils 7.9 (not confirmed against upstream release notes)

Workaround

Unknown. No vendor workaround has been published. Mitigation: make sure credentials files used with mount.cifs as root are owned by root and not writable by other users, and move them out of user-writable directories.

Exploitation

• A public proof-of-concept for local root escalation exists on GitHub (not reviewed by IT Services Schneeberger).
• No evidence of exploitation in the wild was found in one tracker; this must be verified against CISA KEV.
• Red Hat's CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• EPSS is low (about 0.0015 to 0.0027).
• Attack requires local access with low privileges; it is not remotely exploitable.

Our recommendation

• Identify all Linux hosts with cifs-utils and their distribution versions.
• Apply the vendor update for each distribution, starting with multi-user and server systems.
• Review fstab entries, systemd mount units, autofs maps and scripts that run mount.cifs as root with a credentials= file.
• Restrict ownership and permissions of credentials files to root and move them out of user-writable locations.
• Monitor for unexpected mount options and re-check the Red Hat advisory and NVD once populated, as CVSS and CWE data currently differ between sources.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  M3aCulpa/CVE-2026-104715

Research sources

• Red Hat CVE page CVE-2026-104715 access.redhat.com
• Red Hat Bugzilla 2545023 bugzilla.redhat.com
• oss-security post (Openwall) www.openwall.com
• Ubuntu CVE-2026-104715 ubuntu.com
• Ubuntu USN-8938-1 ubuntu.com
• SUSE advisory SUSE-SU-2026:4897-1 vulners.com
• Azure Linux pull request upgrading cifs-utils to 7.9 github.com
• Public PoC repository (GitHub) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:52.