ExploitPublished 1 Jun 2026

19-Year-Old Linux Kernel Vulnerability Exposes Systems to Root Access

Source SecurityWeek

Severity

Medium

Rated by Threat Radar

Data as of 1 Jun 2026, 21:56 UTC

linux

What to do

AI-suggested

Major Linux distributions have released official patches to address this vulnerability. Users and administrators should apply these updates promptly to remediate the issue. The vulnerability can be mitigated by ensuring that key descriptions are only accepted when generated by the kernel's private spnego_cred and by implementing user-space hardening to verify key origins. If patches cannot be immediately applied, restricting or removing cifs-utils where not needed may reduce exposure. Check vendor advisories for the latest remediation guidance.

Description

Proof-of-concept (PoC) exploit code has been released for the CIFSwitch flaw, which allows low-privileged users to escalate to root on vulnerable Linux systems. The post 19-Year-Old Linux Kernel Vulnerability Exposes Systems to Root Access appeared first on SecurityWeek .

Impact

Successful exploitation allows a low-privileged user on a vulnerable Linux system to gain root-level privileges. This elevates the attacker's control over the system, potentially compromising system integrity and security. The vulnerability affects the CIFS subsystem and cifs-utils helper, which are commonly installed on many Linux distributions. The presence of proof-of-concept exploit code increases the risk of exploitation, though no widespread exploitation in the wild has been reported at the time of this analysis.

Summary

The CIFSwitch vulnerability affects the Linux kernel's CIFS subsystem and the cifs-utils userspace helper responsible for SMB network filesystem operations. When authenticating a mount, the subsystem issues a request_key call for a cifs.spnego key, which is handled by cifs.upcall running as root. The kernel fails to verify the origin of the key description, allowing attackers to craft malicious key descriptions that cause cifs.upcall to switch namespaces to an attacker-controlled PID and load malicious NSS modules. This results in privilege escalation from low-privileged user to root. The vulnerability impacts multiple Linux distributions, with some vulnerable only if cifs-utils is installed. Major distributions have released fixes earlier in the month of the report.

References

securityweek.com/19-year-old-linux-kernel-vulnerability-exposes-systems-to-root-access/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 1 Jun 2026, 11:33 UTC

References

Community reviews

Related threats