USN-8496-2
cifs-utils regression
USN-8496-1 fixed a vulnerability in cifs-utils. Unfortunately, the fix introduced a regression with Kerberos mounts. This update reverts the security update until a complete fix is available.
We apologize for the inconvenience.
Original advisory details:
It was discovered that cifs-utils incorrectly dropped root privileges before looking up user information. A local attacker could possibly use this issue to execute arbitrary code as the root user.
What each source reports
OSV No score
cifs-utils regression
USN-8496-1 fixed a vulnerability in cifs-utils. Unfortunately, the fix introduced a regression with Kerberos mounts. This update reverts the security update until a complete fix is available.
We apologize for the inconvenience.
Original advisory details:
It was discovered that cifs-utils incorrectly dropped root privileges before looking up user information. A local attacker could possibly use this issue to execute arbitrary code as the root user.
- Record
USN-8496-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cifs-utilsUbuntu:22.04:LTS |
before 2:6.14-1ubuntu0.5, plus listed versions 2:6.11-3.12:6.14-12:6.14-1build12:6.14-1ubuntu0.12:6.14-1ubuntu0.22:6.14-1ubuntu0.32:6.14-1ubuntu0.4 |
2:6.14-1ubuntu0.5 |
cifs-utilsUbuntu:24.04:LTS |
before 2:7.0-2ubuntu0.4, plus listed versions 2:7.0-22:7.0-2build12:7.0-2ubuntu0.12:7.0-2ubuntu0.22:7.0-2ubuntu0.3 |
2:7.0-2ubuntu0.4 |
cifs-utilsUbuntu:25.10 |
before 2:7.4-1ubuntu0.25.10.2, plus listed versions 2:7.2-22:7.3-12:7.4-12:7.4-1ubuntu0.25.10.1 |
2:7.4-1ubuntu0.25.10.2 |
cifs-utilsUbuntu:26.04:LTS |
before 2:7.4-1ubuntu0.26.04.2, plus listed versions 2:7.4-12:7.4-1build12:7.4-1ubuntu0.26.04.1 |
2:7.4-1ubuntu0.26.04.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-8496-2 is a vulnerability with no CVSS score yet in cifs-utils, published July 3, 2026. No source lists public exploit code. Fixed in cifs-utils 2:6.14-1ubuntu0.5.