CIFSwitch Vulnerability in Linux Allows Root Access via CIFS Exploit

Bleepingcomputer

CIFSwitch Vulnerability in Linux Allows Root Access via CIFS Exploit

First seen 30 May 2026, 14:51 UTC • •70.5

Article Content

1 / 6

Browse articles

ThreatCluster •May 31, 2026 at 14:48 UTC

•CIFSwitch vulnerability allows root access via forged CIFS authentication requests.
•Multiple Linux distributions, including Ubuntu and Debian, are affected by this flaw.
•A patch has been released to fix the vulnerability by validating request origins.

A local privilege escalation vulnerability named 'CIFSwitch' has been discovered in the Linux kernel, enabling low-privileged users to gain root access. This flaw affects multiple Linux distributions that use vulnerable versions of the kernel's CIFS and cifs-utils. The vulnerability arises from the kernel's failure to verify the origin of cifs.spnego key requests, allowing attackers to forge requests. Distributions such as Ubuntu, Debian, and openSUSE are confirmed to be vulnerable under default configurations. A patch has been released to address the issue by validating request origins. The researcher, Asim Manizada, has provided a detailed technical report and proof of concept to aid in assessing exposure. Exploitation depends on several factors, including kernel and cifs-utils versions and specific security policies. Some distributions, including Amazon Linux 2 and certain versions of Kali Linux, are not affected due to their cifs-utils versions lacking the necessary functionality.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 102d ago How this analysis works

Timeline

2026-05-28

CIFSwitch vulnerability disclosed

Asim Manizada published details of the CIFSwitch vulnerability, enabling root access through forged requests.

Cybersecuritynews

2026-05-30

Patch released for CIFSwitch vulnerability

A kernel patch was issued to validate cifs.spnego request origins, mitigating the risk of exploitation.

Bleepingcomputer

More articles in this cluster (5)

Threat Graph

9 entities, 14 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Zero-day Exploit
T1068 - Exploitation for Privilege Escalation

Weakness (1)

CWE-269 - Improper Privilege Management

Affected Platform (5)

CIFS
Cifs-utils
Linux
SMB
Windows

Vulnerability (1)

CIFSwitch

Relationships

CIFSwitch targets CIFS
CIFSwitch targets Cifs-utils
CIFSwitch targets Linux
CIFSwitch targets SMB
Zero-day Exploit targets CIFS
Zero-day Exploit targets Cifs-utils
Zero-day Exploit targets Linux
Zero-day Exploit targets SMB
T1068 - Exploitation for Privilege Escalation targets CIFS
T1068 - Exploitation for Privilege Escalation targets Cifs-utils
T1068 - Exploitation for Privilege Escalation targets Linux
T1068 - Exploitation for Privilege Escalation targets SMB
CIFSwitch related to CWE-269 - Improper Privilege Management
CIFSwitch related to Windows

Continue Reading

Critical Cisco FMC Vulnerabilities Under Active Exploitation Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and…

BlueMoon Exploit Kit Targeting Chrome and Windows by Multiple State Actors A new exploit kit named BlueMoon has been rapidly adopted by at least four espionage groups, primarily linked to China, exploiting vulnerabilities in Google Chrome and Microsoft Windows. The first observed use of BlueMoon was on August 28, 2026, by the China-aligned threat actor TA412, with subsequent adoption by…