Back Linuxsecurity

Oracle Linux 8 cifs-utils Important Bug Fix CVE-2026-12505 ELSA-2026

Linuxsecurity •LinuxSecurity Advisories • July 17, 2026

[7.0-5] - resolves: RHEL-192933 - fix krb5 mount regression [7.0-4] - cifs.upcall: remove getpwuid dependency - cifs.upcall: fix compiler warning with -Wvla - Resolves: RHEL-185759 - Fix CVE-2026-12505 [7.0-3] - docs: update echo_interval description - Resolves: RHEL-80397 [7.0-2] - mount.cifs.rst: add missing reference for sssd - mount.cifs.rst: update section xattr/acl support - Resolves: RHEL-41059

cifs-utils-7.0-5.el8_10.x86_64.rpm cifs-utils-devel-7.0-5.el8_10.i686.rpm cifs-utils-devel-7.0-5.el8_10.x86_64.rpm pam_cifscreds-7.0-5.el8_10.x86_64.rpm

cifs-utils-7.0-5.el8_10.aarch64.rpm cifs-utils-devel-7.0-5.el8_10.aarch64.rpm pam_cifscreds-7.0-5.el8_10.aarch64.rpm

Related CVEs: CVE-2026-12505

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Bug Fix for CVE-2026-12505 in Oracle Linux 8 and 9 Oracle has released important bug fixes for CVE-2026-12505 affecting cifs-utils in both Oracle Linux 8 and 9. The vulnerability allows local privilege escalation (LPE) through cifs.spnego, impacting users of both distributions. The CVE was published on 2026-06-18, and the fixes were released on 2026-07-17. Users are advised to update their systems promptly to mitigate potential exploitation. The fixes address issues such as krb5 mount regression and compiler warnings. Both Oracle Linux 8 and 9 are affected, with specific updates provided for each version. The updates include version 7.0-5 for Oracle Linux 8 and version 7.6-2 for Oracle Linux 9, which resolve the identified vulnerabilities. 2 sources 71

Extracted Entities

CVEs (1)

CVE-2026-12505

Platforms (1)

Oracle Linux