CVE-2026-64137

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> smb: client: require net admin for CIFS SWN netlink<br /> <br /> CIFS_GENL_CMD_SWN_NOTIFY is the userspace witness-notify command. The<br /> intended sender is the cifs.witness helper, but the generic-netlink<br /> operation currently has no capability flag, so any local process can send<br /> RESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness<br /> handler.<br /> <br /> The same family exposes CIFS_GENL_MCGRP_SWN without multicast-group<br /> capability flags. Register messages sent to that group include the witness<br /> registration id and, for NTLM-authenticated mounts, the username, domain,<br /> and password attributes copied from the CIFS session. An unprivileged<br /> local process should not be able to join that group and receive those<br /> messages.<br /> <br /> Require CAP_NET_ADMIN for incoming SWN_NOTIFY commands with<br /> GENL_ADMIN_PERM, and require CAP_NET_ADMIN over the network namespace for<br /> joining the SWN multicast group with GENL_MCAST_CAP_NET_ADMIN. The<br /> cifs.witness service runs with the privileges needed for both operations.