CVE-2026-104715

A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.

Red Hat has classified this vulnerability as having an Important severity impact because a local unprivileged user could leverage parameter injection in privileged mount workflows to attain full administrative privileges. In default Red Hat Enterprise Linux installations, CIFS mount utilities are not configured to automatically mount shares using unprivileged user-controlled credentials, significantly limiting exposure. Exploitation is constrained to non-standard environments where system-level helpers or automation, such as pam_mount, are explicitly configured to mount shares using credentials files located in user-writable directories.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.