CVE-2026-64137

In the Linux kernel, the following vulnerability has been resolved: smb: client: require net admin for CIFS SWN netlink CIFS_GENL_CMD_SWN_NOTIFY is the userspace witness-notify command. The intended sender is the cifs.witness helper, but the generic-netlink operation currently has no capability flag, so any local process can send RESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness handler. The same family exposes CIFS_GENL_MCGRP_SWN without multicast-group capability flags. Register messages sent to that group include the witness registration id and, for NTLM-authenticated mounts, the username, domain, and password attributes copied from the CIFS session. An unprivileged local process should not be able to join that group and receive those messages. Require CAP_NET_ADMIN for incoming SWN_NOTIFY commands with GENL_ADMIN_PERM, and require CAP_NET_ADMIN over the network namespace for joining the SWN multicast group with GENL_MCAST_CAP_NET_ADMIN. The cifs.witness service runs with the privileges needed for both operations.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/969bc6370334a5b4720c5470783295d6484bbc95
https://git.kernel.org/stable/c/9919021a3b7974ae66a5f9915e3a48c10cfd409b
https://git.kernel.org/stable/c/9cf7eb8919344932f909b2fac76296f7656fda8d
https://git.kernel.org/stable/c/a3238b09c58f323e40743ce174cd0ab81b5c09ed
https://git.kernel.org/stable/c/a8d17d22db591099519a89f14dd24810daba74c3
https://git.kernel.org/stable/c/c2397b93fbb6f44a788fff30f99be2c20cc5e50f
https://git.kernel.org/stable/c/d1ebfce2c1d161186a82e77590bf7da2ea1bce91

Configurations

No configuration.

History

20 Jul 2026, 15:17

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8

19 Jul 2026, 16:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-19 16:17

Updated : 2026-07-20 15:17

NVD link : CVE-2026-64137

Mitre link : CVE-2026-64137

CVE.ORG link : CVE-2026-64137

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-64137", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8", "lessThan": "9cf7eb8919344932f909b2fac76296f7656fda8d", "versionType": "git"}, {"status": "affected", "version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8", "lessThan": "9919021a3b7974ae66a5f9915e3a48c10cfd409b", "versionType": "git"}, {"status": "affected", "version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8", "lessThan": "969bc6370334a5b4720c5470783295d6484bbc95", "versionType": "git"}, {"status": "affected", "version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8", "lessThan": "a3238b09c58f323e40743ce174cd0ab81b5c09ed", "versionType": "git"}, {"status": "affected", "version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8", "lessThan": "a8d17d22db591099519a89f14dd24810daba74c3", "versionType": "git"}, {"status": "affected", "version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8", "lessThan": "c2397b93fbb6f44a788fff30f99be2c20cc5e50f", "versionType": "git"}, {"status": "affected", "version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8", "lessThan": "d1ebfce2c1d161186a82e77590bf7da2ea1bce91", "versionType": "git"}], "programFiles": ["fs/smb/client/netlink.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"status": "unaffected", "version": "0", "lessThan": "5.11", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.210", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.176", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.143", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.92", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.34", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.11", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/smb/client/netlink.c"], "defaultStatus": "affected"}]}], "published": "2026-07-19T16:17:55.570", "references": [{"url": "https://git.kernel.org/stable/c/969bc6370334a5b4720c5470783295d6484bbc95", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9919021a3b7974ae66a5f9915e3a48c10cfd409b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9cf7eb8919344932f909b2fac76296f7656fda8d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a3238b09c58f323e40743ce174cd0ab81b5c09ed", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a8d17d22db591099519a89f14dd24810daba74c3", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c2397b93fbb6f44a788fff30f99be2c20cc5e50f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d1ebfce2c1d161186a82e77590bf7da2ea1bce91", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: require net admin for CIFS SWN netlink\n\nCIFS_GENL_CMD_SWN_NOTIFY is the userspace witness-notify command. The\nintended sender is the cifs.witness helper, but the generic-netlink\noperation currently has no capability flag, so any local process can send\nRESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness\nhandler.\n\nThe same family exposes CIFS_GENL_MCGRP_SWN without multicast-group\ncapability flags. Register messages sent to that group include the witness\nregistration id and, for NTLM-authenticated mounts, the username, domain,\nand password attributes copied from the CIFS session. An unprivileged\nlocal process should not be able to join that group and receive those\nmessages.\n\nRequire CAP_NET_ADMIN for incoming SWN_NOTIFY commands with\nGENL_ADMIN_PERM, and require CAP_NET_ADMIN over the network namespace for\njoining the SWN multicast group with GENL_MCAST_CAP_NET_ADMIN. The\ncifs.witness service runs with the privileges needed for both operations."}], "lastModified": "2026-07-20T15:17:11.847", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}