Reported by 1 outlet
CIFSwitch — 19-Year-Old Linux Kernel Privilege Escalation Gives Root on Multiple Distributions, PoC Published
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
CIFSwitch — 19-Year-Old Linux Kernel Privilege Escalation Gives Root on Multiple Distributions, PoC Published
bleepingcomputer.com · 136d ago · May 31st, 2026
SpaceX security engineer Asim Viladi Oglu Manizada discovered and disclosed a local privilege escalation vulnerability in the Linux kernel's CIFS subsystem, dubbed CIFSwitch, that allows an unprivileged user to forge
cifs.spnegokey requests and abuse the kernel's authentication workflow to load a malicious NSS module — achieving root code execution.The vulnerability was introduced in 2007 and affects vulnerable combinations of Linux kernel CIFS + cifs-utils (version 6.14+). Confirmed vulnerable with default configurations: Linux Mint 21.3/22.3, CentOS Stream 9, Rocky Linux 9, AlmaLinux 9, Kali Linux 2021.4–2026.1, SLES 15 SP7. Ubuntu, Debian, Pop!_OS, and other distributions may be vulnerable if cifs-utils is installed. Ubuntu 26.04, Fedora 40+, CentOS Stream 10, and SLES 16 have default SELinux/AppArmor policies that block the attack. Fixed via kernel commit 3da1fdf (adds origin validation to cifs.spnego requests). Mitigations: disable/blacklist CIFS module if unused, remove cifs-utils, or disable unprivileged user namespaces. Manizada has published a PoC exploit.