New Linux CIFSwitch Kernel Vulnerability Allows Attackers to Gain Root Access

Cybersecuritynews •Abinaya • May 28, 2026

A newly disclosed Linux local privilege escalation (LPE) vulnerability dubbed “CIFSwitch” enables low-privileged users to gain root access by abusing a logic flaw between the Linux kernel CIFS client and the userspace cifs-utils package. The bug was discovered by security researcher Asim Manizada, who has published a detailed technical write-up and PoC to help defenders assess their exposure […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CIFSwitch Vulnerability in Linux Allows Root Access via CIFS Exploit A local privilege escalation vulnerability named 'CIFSwitch' has been discovered in the Linux kernel, enabling low-privileged users to gain root access. This flaw affects multiple Linux distributions that use vulnerable versions of the kernel's CIFS and cifs-utils. The vulnerability arises from the kernel's failure to verify the origin of cifs.spnego key requests, allowing attackers to forge requests. Distributions such as Ubuntu, Debian, and openSUSE are confirmed to be vulnerable under default configurations. A patch has been released to address the issue by validating request origins. The researcher, Asim Manizada, has provided a detailed technical report and proof of concept to aid in assessing exposure. Exploitation depends on several factors, including kernel and cifs-utils versions and specific security policies. Some distributions, including Amazon Linux 2 and certain versions of Kali Linux, are not affected due to their cifs-utils versions lacking the necessary functionality. 5 sources 71

Extracted Entities

New Linux CIFSwitch Kernel Vulnerability Allows Attackers to Gain Root Access

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)

Vulnerabilities (1)