New CIFSwitch Linux flaw gives root on multiple distributions
Source Bleeping Computer
Rated by Threat Radar
Data as of 1 Jun 2026, 21:57 UTC
What to do
AI-suggested
A kernel patch fixing CIFSwitch has been released upstream (commit 3da1fdf) and is included in various distribution updates; users should apply the latest kernel updates from their Linux distribution vendors to remediate the vulnerability. Additionally, users should disable or blacklist the CIFS kernel module if it is not in use, remove the cifs-utils package if unnecessary, and disable unprivileged user namespaces to reduce attack surface. Some distributions' default SELinux/AppArmor policies may already mitigate exploitation. Organizations should consult their vendor advisories for exact patched kernel versions and apply those updates accordingly. The published proof-of-concept exploit can be used to verify the effectiveness of applied patches and mitigations.
Description
A newly discovered local privilege escalation vulnerability dubbed 'CIFSwitch' in the Linux kernel could allow attackers to forge CIFS authentication key descriptions, abuse the kernel's key request mechanism, and gain root privileges. [...]