CVE-2026-64137

A flaw was found in the Linux kernel's Common Internet File System (CIFS) client. This vulnerability allows an unprivileged local user to send witness notifications or join a specific multicast group without proper administrative privileges. Exploiting this flaw could lead to information disclosure, as sensitive data such as usernames, domains, and passwords from NTLM-authenticated mounts might be exposed to the unauthorized process. This issue arises from missing capability checks in the generic netlink operations for CIFS witness notifications.

A flaw was found in the Linux kernel's CIFS client witness notification (SWN) generic netlink interface. The CIFS_GENL_CMD_SWN_NOTIFY command and the CIFS_GENL_MCGRP_SWN multicast group were exposed without capability checks, so an unprivileged local process could send RESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness handler and could join the SWN multicast group to receive witness register messages. Those messages include the witness registration id and, for NTLM-authenticated mounts, the username, domain, and password attributes copied from the CIFS session, so exploitation could allow a local attacker to disclose SMB session credentials. Red Hat Product Security has rated this flaw as IMPORTANT with a CVSS 3.1 score of 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), lower than the 7.8 score assigned by CVE.org (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a higher attack complexity. No Red Hat products are affected by this flaw: all shipped Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams are recorded as not affected because the vulnerable code is not present in the shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.