CVE-2026-104715
Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.
- Record
CVE-2026-104715- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-88
- Updated
- 2026-11-04
EUVDEUVD-2026-102803
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.
- Record
EUVD-2026-102803- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-pvh7-9hhh-pfhr
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege...
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.
- Record
GHSA-pvh7-9hhh-pfhr- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-88
- Updated
- 2026-11-02
NVD
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.
- Record
CVE-2026-104715- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-88
- Updated
- 2026-11-04
OSVALPINE-CVE-2026-104715
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.
- Record
ALPINE-CVE-2026-104715- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-104715
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.
- Record
DEBIAN-CVE-2026-104715- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
Show 11 moreShow less
OSVUBUNTU-CVE-2026-104715
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.
- Record
UBUNTU-CVE-2026-104715- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-109782 No score
CVE-2026-104715 affecting package cifs-utils for versions less than 7.9-1
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.
- Record
AZL-109782- Updated
- 2026-11-02
OSVCLSA-2026-1792790974 No score
Fix CVE(s): CVE-2026-104715
- SECURITY UPDATE: mount option injection via credentials file values
- debian/patches/CVE-2026-104715.patch: in mount.cifs.c, reject username= and domain= values from a credentials file, and the USER environment variable or passwd login name, that contain an option delimiter (comma, equals, CR or LF) before they are assembled into the kernel mount option string.
- CVE-2026-104715
- Record
CLSA-2026-1792790974- Updated
- 2026-11-02
OSVMGASA-2026-0556 No score
Updated cifs-utils package fixes a security vulnerability
cifs-utils 4.2-7.8 mount-option injection in mount.cifs. (CVE-2026-104715)
- Record
MGASA-2026-0556- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:22170-1 No score
Security update for cifs-utils
This update for cifs-utils fixes the following issue:
- CVE-2026-104715: mount options injection via CIFS credentials-file parsing (bsc#1284932).
- Record
openSUSE-SU-2026:22170-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:24372-1 No score
Security update for cifs-utils
This update for cifs-utils fixes the following issue:
- CVE-2026-104715: mount options injection via CIFS credentials-file parsing (bsc#1284932).
- Record
SUSE-SU-2026:24372-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:24435-1 No score
Security update for cifs-utils
This update for cifs-utils fixes the following issue:
- CVE-2026-104715: mount options injection via CIFS credentials-file parsing (bsc#1284932).
- Record
SUSE-SU-2026:24435-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:24462-1 No score
Security update for cifs-utils
This update for cifs-utils fixes the following issue:
- CVE-2026-104715: mount options injection via CIFS credentials-file parsing (bsc#1284932).
- Record
SUSE-SU-2026:24462-1- Updated
- 2026-11-04
OSVSUSE-SU-2026:4819-1 No score
Security update for cifs-utils
This update for cifs-utils fixes the following issue:
- CVE-2026-104715: mount options injection via CIFS credentials-file parsing (bsc#1284932).
- Record
SUSE-SU-2026:4819-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4897-1 No score
Security update for cifs-utils
This update for cifs-utils fixes the following issue:
- CVE-2026-104715: mount options injection via CIFS credentials-file parsing (bsc#1284932).
- Record
SUSE-SU-2026:4897-1- Updated
- 2026-11-02
OSVUSN-8938-1 No score
cifs-utils vulnerability
It was discovered that cifs-utils incorrectly handled credentials files used by privileged mount.cifs invocations. A local attacker could possibly use this issue to inject arbitrary mount options into a privileged mount, resulting in a privilege escalation.
- Record
USN-8938-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cifs-utilsAlpine:v3.21 |
before 7.1-r1 | 7.1-r1 |
cifs-utilsAlpine:v3.22 |
before 7.3-r1 | 7.3-r1 |
cifs-utilsAlpine:v3.23 |
before 7.4-r1 | 7.4-r1 |
cifs-utilsAlpine:v3.24 |
before 7.5-r1 | 7.5-r1 |
cifs-utilsAzure Linux:3 |
before 7.9-1 | 7.9-1 |
cifs-utilsTuxCare:Debian:10 |
before 2:6.8-2+deb10u1+tuxcare.els1 | 2:6.8-2+deb10u1+tuxcare.els1 |
cifs-utilsDebian:12 |
All versions, plus listed versions 2:7.0-22:7.0-2.12:7.1-12:7.2-12:7.2-2 Show 4 moreShow less2:7.3-12:7.4-12:7.8-12:7.9-1 |
None known |
cifs-utilsDebian:13 |
before 2:7.4-1+deb13u1, plus listed versions 2:7.4-1 |
2:7.4-1+deb13u1 |
cifs-utilsDebian:14 |
before 2:7.9-1, plus listed versions 2:7.4-12:7.8-1 |
2:7.9-1 |
cifs-utilsMageia:10 |
before 7.5-1.2.mga10 | 7.5-1.2.mga10 |
Show 29 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cifs-utilsSUSE:Linux Micro 6.0 |
before 7.0-159998.1.1 | 7.0-159998.1.1 |
cifs-utilsSUSE:Linux Micro 6.2 |
before 7.4-160000.3.1 | 7.4-160000.3.1 |
cifs-utilsSUSE:Linux Enterprise Server 16.0 |
before 7.4-160000.3.1 | 7.4-160000.3.1 |
cifs-utilsSUSE:Linux Enterprise Server for SAP applications 16.0 |
before 7.4-160000.3.1 | 7.4-160000.3.1 |
cifs-utilsSUSE:Linux Enterprise Micro 5.3 |
before 6.15-150400.3.27.1 | 6.15-150400.3.27.1 |
cifs-utilsSUSE:Linux Enterprise Micro 5.4 |
before 6.15-150400.3.27.1 | 6.15-150400.3.27.1 |
cifs-utilsSUSE:Linux Enterprise Micro 5.5 |
before 6.15-150400.3.27.1 | 6.15-150400.3.27.1 |
cifs-utilsSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 6.15-150400.3.27.1 | 6.15-150400.3.27.1 |
cifs-utilsSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 6.15-150400.3.27.1 | 6.15-150400.3.27.1 |
cifs-utilsSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 6.15-150400.3.27.1 | 6.15-150400.3.27.1 |
cifs-utilsSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 6.15-150400.3.27.1 | 6.15-150400.3.27.1 |
cifs-utilsSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 6.15-150400.3.27.1 | 6.15-150400.3.27.1 |
cifs-utilsSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 6.15-150400.3.27.1 | 6.15-150400.3.27.1 |
cifs-utilsSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 6.15-150400.3.27.1 | 6.15-150400.3.27.1 |
cifs-utilsSUSE:Linux Enterprise Server 15 SP6-LTSS |
before 6.15-150400.3.27.1 | 6.15-150400.3.27.1 |
cifs-utilsSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 6.15-150400.3.27.1 | 6.15-150400.3.27.1 |
cifs-utilsSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 6.15-150400.3.27.1 | 6.15-150400.3.27.1 |
cifs-utilsSUSE:Linux Enterprise Server for SAP Applications 15 SP6 |
before 6.15-150400.3.27.1 | 6.15-150400.3.27.1 |
cifs-utilsSUSE:Linux Enterprise Server 12 SP5-LTSS |
before 6.9-13.32.2 | 6.9-13.32.2 |
cifs-utilsSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 6.9-13.32.2 | 6.9-13.32.2 |
cifs-utilsUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2:6.0-1ubuntu22:6.0-1ubuntu2+esm1 |
None known |
cifs-utilsUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2:6.4-1ubuntu12:6.4-1ubuntu1.12:6.4-1ubuntu1.1+esm1 |
None known |
cifs-utilsUbuntu:18.04:LTS |
All versions, plus listed versions 2:6.7-12:6.8-12:6.8-1ubuntu12:6.8-1ubuntu1.12:6.8-1ubuntu1.2 |
None known |
cifs-utilsUbuntu:20.04:LTS |
All versions, plus listed versions 2:6.9-0ubuntu12:6.9-12:6.9-1ubuntu0.12:6.9-1ubuntu0.22:6.9-1ubuntu0.32:6.9-1ubuntu0.4 |
None known |
cifs-utilsUbuntu:22.04:LTS |
before 2:6.14-1ubuntu0.7, plus listed versions 2:6.11-3.12:6.14-12:6.14-1build12:6.14-1ubuntu0.12:6.14-1ubuntu0.2 Show 4 moreShow less2:6.14-1ubuntu0.32:6.14-1ubuntu0.42:6.14-1ubuntu0.52:6.14-1ubuntu0.6 |
2:6.14-1ubuntu0.7 |
cifs-utilsUbuntu:24.04:LTS |
before 2:7.0-2ubuntu0.6, plus listed versions 2:7.0-22:7.0-2build12:7.0-2ubuntu0.12:7.0-2ubuntu0.22:7.0-2ubuntu0.32:7.0-2ubuntu0.42:7.0-2ubuntu0.5 |
2:7.0-2ubuntu0.6 |
cifs-utilsUbuntu:26.10 |
before 2:7.4-1ubuntu3.1, plus listed versions 2:7.4-1build12:7.4-1ubuntu3 |
2:7.4-1ubuntu3.1 |
cifs-utilsUbuntu:26.04:LTS |
before 2:7.4-1ubuntu0.26.04.4, plus listed versions 2:7.4-12:7.4-1build12:7.4-1ubuntu0.26.04.12:7.4-1ubuntu0.26.04.22:7.4-1ubuntu0.26.04.3 |
2:7.4-1ubuntu0.26.04.4 |
cifs-utilsopenSUSE:Leap 16.0 |
before 7.4-160000.3.1 | 7.4-160000.3.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | M3aCulpa/CVE-2026-104715 | 2026-10-15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-104715 is a high vulnerability (CVSS 7.8) in Red Hat Enterprise Linux 10, published October 16, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 18th percentile. Fixed in cifs-utils 7.1-r1.
References
access.redhat.com/security/cve/CVE-2026-104715
bugzilla.redhat.com/show_bug.cgi?id=2545023
openwall.com/lists/oss-security/2026/10/16/35
nvd.nist.gov/vuln/detail/CVE-2026-104715
github.com/advisories/GHSA-pvh7-9hhh-pfhr
security.alpinelinux.org/vuln/CVE-2026-104715
Show 18 moreShow less
errata.tuxcare.com/els_os/debian10els/CLSA-2026-1792790974.html
security-tracker.debian.org/tracker/CVE-2026-104715
advisories.mageia.org/MGASA-2026-0556.html
bugs.mageia.org/show_bug.cgi?id=36524
lists.debian.org/debian-security-announce/2026/msg00481.html
lists.samba.org/archive/samba-technical/2026-October/141162.html
lists.fedoraproject.org/archives/list/[email protected]/message/WB362TX7CVA2OXAQXUQYSDPX6JRPMLNG
ubuntu.com/security/notices/USN-8938-1
suse.com/support/update/announcement/2026/suse-su-202624372-1
bugzilla.suse.com/1284932
cve.org/CVERecord?id=CVE-2026-104715