CVE catalog

CVE-2026-12505

A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment. A local, low

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.16% · Oct 25, 2026

A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment. A local, low privileged attacker can exploit this by using a crafted request_key payload to trick the root-owned helper into entering a custom environment (namespace) containing a malicious NSS module. This forces the system to load the attacker's controlled NSS Module and configuration, allowing them to execute arbitrary commands as the root user, elevating their privileges and fully compromising the system.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancifs-utilssid2:7.9-1fixed
Debiancifs-utilsforky2:7.9-1fixed
Debiancifs-utilstrixie2:7.4-1vulnerable
Debiancifs-utilstrixie-security2:7.4-1+deb13u2fixed
Debiancifs-utilsbookworm2:7.0-2vulnerable
Cpecifs-utilsNot reported2:7.0-2ubuntu0.3fixed
Cpecifs-utilsNot reportedNot reportedvulnerable
Cpecifs-utilsNot reported2:7.0-2ubuntu0.5fixed
Susecifs-utilslinux micro 6.17.0-slfo.1.1_4.1fixed
Ubuntucifs-utils22.042:6.11-3.1vulnerable
Ubuntucifs-utils22.042:6.14-1vulnerable
Ubuntucifs-utils22.042:6.14-1build1vulnerable
Ubuntucifs-utils22.042:6.14-1ubuntu0.1vulnerable
Ubuntucifs-utils22.042:6.14-1ubuntu0.2vulnerable
Ubuntucifs-utils22.042:6.14-1ubuntu0.3vulnerable
Ubuntucifs-utils22.042:6.14-1ubuntu0.4vulnerable
Ubuntucifs-utils22.042:6.14-1ubuntu0.5vulnerable
Ubuntucifs-utils22.042:6.14-1ubuntu0.6fixed
Ubuntucifs-utils24.042:7.0-2vulnerable
Ubuntucifs-utils24.042:7.0-2build1vulnerable
Ubuntucifs-utils24.042:7.0-2ubuntu0.1vulnerable
Ubuntucifs-utils24.042:7.0-2ubuntu0.2vulnerable
Ubuntucifs-utils24.042:7.0-2ubuntu0.3vulnerable
Ubuntucifs-utils24.042:7.0-2ubuntu0.4vulnerable
Ubuntucifs-utils24.042:7.0-2ubuntu0.5fixed
Ubuntucifs-utils26.042:7.4-1vulnerable
Ubuntucifs-utils26.042:7.4-1build1vulnerable
Ubuntucifs-utils26.042:7.4-1ubuntu0.26.04.1vulnerable
Ubuntucifs-utils26.042:7.4-1ubuntu0.26.04.2vulnerable
Ubuntucifs-utils26.042:7.4-1ubuntu0.26.04.3fixed
Ubuntucifs-utilspro2:6.4-1ubuntu1vulnerable
Ubuntucifs-utilspro2:6.4-1ubuntu1.1vulnerable
Ubuntucifs-utilspro2:6.4-1ubuntu1.1+esm1vulnerable
Ubuntucifs-utils18.042:6.7-1vulnerable
Ubuntucifs-utils18.042:6.8-1vulnerable
Ubuntucifs-utils18.042:6.8-1ubuntu1vulnerable
Ubuntucifs-utils18.042:6.8-1ubuntu1.1vulnerable
Ubuntucifs-utils18.042:6.8-1ubuntu1.2vulnerable
Ubuntucifs-utils20.042:6.9-0ubuntu1vulnerable
Ubuntucifs-utils20.042:6.9-1vulnerable
Ubuntucifs-utils20.042:6.9-1ubuntu0.1vulnerable
Ubuntucifs-utils20.042:6.9-1ubuntu0.2vulnerable
Ubuntucifs-utils20.042:6.9-1ubuntu0.3vulnerable
Ubuntucifs-utils20.042:6.9-1ubuntu0.4vulnerable
Ubuntucifs-utils22.042:6.11-3.1vulnerable
Ubuntucifs-utils22.042:6.14-1vulnerable
Ubuntucifs-utils22.042:6.14-1build1vulnerable
Ubuntucifs-utils22.042:6.14-1ubuntu0.1vulnerable
Ubuntucifs-utils22.042:6.14-1ubuntu0.2vulnerable
Ubuntucifs-utils22.042:6.14-1ubuntu0.3vulnerable
Ubuntucifs-utils22.042:6.14-1ubuntu0.4vulnerable
Ubuntucifs-utils22.042:6.14-1ubuntu0.5vulnerable
Ubuntucifs-utils22.042:6.14-1ubuntu0.6fixed
Ubuntucifs-utils24.042:7.0-2vulnerable
Ubuntucifs-utils24.042:7.0-2build1vulnerable
Ubuntucifs-utils24.042:7.0-2ubuntu0.1vulnerable
Ubuntucifs-utils24.042:7.0-2ubuntu0.2vulnerable
Ubuntucifs-utils24.042:7.0-2ubuntu0.3vulnerable
Ubuntucifs-utils24.042:7.0-2ubuntu0.4vulnerable
Ubuntucifs-utils24.042:7.0-2ubuntu0.5fixed
Ubuntucifs-utils25.102:7.2-2vulnerable
Ubuntucifs-utils25.102:7.3-1vulnerable
Ubuntucifs-utils25.102:7.4-1vulnerable
Ubuntucifs-utils25.102:7.4-1ubuntu0.25.10.1vulnerable
Ubuntucifs-utils25.102:7.4-1ubuntu0.25.10.2vulnerable
Ubuntucifs-utils26.042:7.4-1vulnerable
Ubuntucifs-utils26.042:7.4-1build1vulnerable
Ubuntucifs-utils26.042:7.4-1ubuntu0.26.04.1vulnerable
Ubuntucifs-utils26.042:7.4-1ubuntu0.26.04.2vulnerable
Ubuntucifs-utils26.042:7.4-1ubuntu0.26.04.3fixed
Ubuntucifs-utils22.042:6.11-3.1vulnerable
Ubuntucifs-utils22.042:6.14-1vulnerable
Ubuntucifs-utils22.042:6.14-1build1vulnerable
Ubuntucifs-utils22.042:6.14-1ubuntu0.1vulnerable
Ubuntucifs-utils22.042:6.14-1ubuntu0.2vulnerable
Ubuntucifs-utils22.042:6.14-1ubuntu0.3vulnerable
Ubuntucifs-utils22.042:6.14-1ubuntu0.4fixed
Ubuntucifs-utils24.042:7.0-2vulnerable
Ubuntucifs-utils24.042:7.0-2build1vulnerable
Ubuntucifs-utils24.042:7.0-2ubuntu0.1vulnerable
Ubuntucifs-utils24.042:7.0-2ubuntu0.2vulnerable
Ubuntucifs-utils24.042:7.0-2ubuntu0.3fixed
Ubuntucifs-utils25.102:7.2-2vulnerable
Ubuntucifs-utils25.102:7.3-1vulnerable
Ubuntucifs-utils25.102:7.4-1vulnerable
Ubuntucifs-utils25.102:7.4-1ubuntu0.25.10.1fixed
Ubuntucifs-utils26.042:7.4-1vulnerable
Ubuntucifs-utils26.042:7.4-1build1vulnerable
Ubuntucifs-utils26.042:7.4-1ubuntu0.26.04.1fixed
Susecifs-utilslinux enterprise micro 5.36.15-150400.3.21.1fixed
Susecifs-utilslinux enterprise micro 5.46.15-150400.3.21.1fixed
Susecifs-utilslinux enterprise micro 5.56.15-150400.3.21.1fixed
Susecifs-utilslinux enterprise module for basesystem 15 sp76.15-150400.3.21.1fixed
Susecifs-utilslinux enterprise high performance computing 15 sp4-espos6.15-150400.3.21.1fixed
Susecifs-utilslinux enterprise high performance computing 15 sp4-ltss6.15-150400.3.21.1fixed
Susecifs-utilslinux enterprise high performance computing 15 sp5-espos6.15-150400.3.21.1fixed
Susecifs-utilslinux enterprise high performance computing 15 sp5-ltss6.15-150400.3.21.1fixed
Susecifs-utilslinux enterprise server 15 sp4-ltss6.15-150400.3.21.1fixed
Susecifs-utilslinux enterprise server 15 sp5-ltss6.15-150400.3.21.1fixed
Susecifs-utilslinux enterprise server 15 sp6-ltss6.15-150400.3.21.1fixed
Susecifs-utilslinux enterprise server for sap applications 15 sp46.15-150400.3.21.1fixed
Susecifs-utilslinux enterprise server for sap applications 15 sp56.15-150400.3.21.1fixed
Susecifs-utilslinux enterprise server for sap applications 15 sp66.15-150400.3.21.1fixed
Susecifs-utilslinux enterprise server 12 sp5-ltss6.9-13.26.1fixed
Susecifs-utilslinux enterprise server ltss extended security 12 sp56.9-13.26.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancifs-utilssourcesid2:7.8-1not yet assignedNot reported[1140422]
Debiancifs-utilssourceforky2:7.8-1not yet assignedNot reported[1140422]
Debiancifs-utilssourcetrixie2:7.4-1+deb13u1not yet assignedNot reported[1140422]
Debiancifs-utilssourcebookworm(unfixed)not yet assignedNot reported[1140422]
Cpecifs-utilscpeNot reported2:7.0-2ubuntu0.3Not reportedNot reportedNot reported
Cpecifs-utilscpeNot reported2:7.0-2ubuntu0.5Not reportedNot reportedNot reported
Susecifs-utilsrpmlinux micro 6.17.0-slfo.1.1_4.1Not reportedSUSE-SU-2026:22888-1Not reported
Ubuntucifs-utilsdeb22.042:6.14-1ubuntu0.6Not reportedUSN-8496-3Not reported
Ubuntucifs-utilsdeb24.042:7.0-2ubuntu0.5Not reportedUSN-8496-3Not reported
Ubuntucifs-utilsdeb26.042:7.4-1ubuntu0.26.04.3Not reportedUSN-8496-3Not reported
Ubuntucifs-utilsdeb22.042:6.14-1ubuntu0.6Not reportedUBUNTU-CVE-2026-12505Not reported
Ubuntucifs-utilsdeb24.042:7.0-2ubuntu0.5Not reportedUBUNTU-CVE-2026-12505Not reported
Ubuntucifs-utilsdeb26.042:7.4-1ubuntu0.26.04.3Not reportedUBUNTU-CVE-2026-12505Not reported
Ubuntucifs-utilsdeb22.042:6.14-1ubuntu0.4Not reportedUSN-8496-1Not reported
Ubuntucifs-utilsdeb24.042:7.0-2ubuntu0.3Not reportedUSN-8496-1Not reported
Ubuntucifs-utilsdeb25.102:7.4-1ubuntu0.25.10.1Not reportedUSN-8496-1Not reported
Ubuntucifs-utilsdeb26.042:7.4-1ubuntu0.26.04.1Not reportedUSN-8496-1Not reported
Susecifs-utilsrpmlinux enterprise micro 5.36.15-150400.3.21.1Not reportedSUSE-SU-2026:2699-1Not reported
Susecifs-utilsrpmlinux enterprise micro 5.46.15-150400.3.21.1Not reportedSUSE-SU-2026:2699-1Not reported
Susecifs-utilsrpmlinux enterprise micro 5.56.15-150400.3.21.1Not reportedSUSE-SU-2026:2699-1Not reported
Susecifs-utilsrpmlinux enterprise module for basesystem 15 sp76.15-150400.3.21.1Not reportedSUSE-SU-2026:2699-1Not reported
Susecifs-utilsrpmlinux enterprise high performance computing 15 sp4-espos6.15-150400.3.21.1Not reportedSUSE-SU-2026:2699-1Not reported
Susecifs-utilsrpmlinux enterprise high performance computing 15 sp4-ltss6.15-150400.3.21.1Not reportedSUSE-SU-2026:2699-1Not reported
Susecifs-utilsrpmlinux enterprise high performance computing 15 sp5-espos6.15-150400.3.21.1Not reportedSUSE-SU-2026:2699-1Not reported
Susecifs-utilsrpmlinux enterprise high performance computing 15 sp5-ltss6.15-150400.3.21.1Not reportedSUSE-SU-2026:2699-1Not reported
Susecifs-utilsrpmlinux enterprise server 15 sp4-ltss6.15-150400.3.21.1Not reportedSUSE-SU-2026:2699-1Not reported
Susecifs-utilsrpmlinux enterprise server 15 sp5-ltss6.15-150400.3.21.1Not reportedSUSE-SU-2026:2699-1Not reported
Susecifs-utilsrpmlinux enterprise server 15 sp6-ltss6.15-150400.3.21.1Not reportedSUSE-SU-2026:2699-1Not reported
Susecifs-utilsrpmlinux enterprise server for sap applications 15 sp46.15-150400.3.21.1Not reportedSUSE-SU-2026:2699-1Not reported
Susecifs-utilsrpmlinux enterprise server for sap applications 15 sp56.15-150400.3.21.1Not reportedSUSE-SU-2026:2699-1Not reported
Susecifs-utilsrpmlinux enterprise server for sap applications 15 sp66.15-150400.3.21.1Not reportedSUSE-SU-2026:2699-1Not reported
Susecifs-utilsrpmlinux enterprise server 12 sp5-ltss6.9-13.26.1Not reportedSUSE-SU-2026:2700-1Not reported
Susecifs-utilsrpmlinux enterprise server ltss extended security 12 sp56.9-13.26.1Not reportedSUSE-SU-2026:2700-1Not reported

[Debian bug #1140422]

Notes

[bookworm] cifs-utils: Minor issue; local privesc via cifs.upcall getpwuid in caller ns

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [cifs-utils]Affected
    Details (2)

    • 2:7.0-2 · amd64 · bookworm

      Affected

      nvd · cifs-utils · debian · bookworm

    • 2:7.0-2 · arm64 · bookworm

      Affected

      nvd · cifs-utils · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]