The Linux kernel SMB client exposed a vulnerability where the CIFS_GENL_CMD_SWN_NOTIFY userspace witness-notify command and the CIFS_GENL_MCGRP_SWN multicast group lacked proper capability restrictions. This allowed any local unprivileged process to send RESOURCE_CHANGE or CLIENT_MOVE notifications to the kernel witness handler and to join the multicast group receiving messages containing sensitive session data such as usernames, domains, and passwords from NTLM-authenticated mounts. The vulnerability was addressed by requiring CAP_NET_ADMIN capability for processing incoming SWN_NOTIFY commands and for joining the SWN multicast group, ensuring only the cifs.witness helper with appropriate privileges can perform these operations.

Unprivileged local users could send unauthorized witness notifications to the kernel or receive sensitive CIFS session credentials by joining a multicast group, potentially leading to unauthorized information disclosure or interference with CIFS witness operations.

The vulnerability has been resolved by enforcing CAP_NET_ADMIN capability checks on relevant netlink operations and multicast group membership. The cifs.witness service runs with the necessary privileges to perform these actions. No further action is required if the system is updated with the fixed kernel version. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.