Bug 2489805 (CVE-2026-12505)

Summary: CVE-2026-12505 cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment. A local, low privileged attacker can exploit this by using a crafted request_key payload to trick the root-owned helper into entering a custom environment (namespace) containing a malicious NSS module. This forces the system to load the attacker's controlled NSS Module and configuration, allowing them to execute arbitrary commands as the root user, elevating their privileges and fully compromising the system.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2489808    
Bug Blocks:    

Description OSIDB Bzimport 2026-06-17 10:22:02 UTC 
The vulnerability affects cifs.upcall in cifs-utils. When processing a cifs.spnego key request, cifs.upcall may switch into attacker-controlled namespaces before fully dropping its root privileges. During this transition, the helper performs NSS lookups using getpwuid() while still retaining privileged kernel credentials. An attacker may create a controlled user and mount namespace containing a malicious NSS configuration and NSS module. By triggering a crafted cifs.spnego request through request_key(), the attacker can cause cifs.upcall to load the malicious NSS module before privileges are fully dropped.