CVE-2026-64137

What it actually does

This is a Linux kernel SMB/CIFS client authorization flaw in the CIFS witness netlink interface. Before the fix, local unprivileged processes could send CIFS witness notification commands, such as resource-change or client-move events, to the in-kernel CIFS witness handler without CAP_NET_ADMIN. They could also join the CIFS witness multicast group and receive witness registration messages. For NTLM-authenticated CIFS mounts, those multicast messages may contain sensitive session attributes including username, domain, and password data copied from the CIFS session. The result is a local privilege-boundary bypass that can expose SMB credentials and allow local users to inject false CIFS failover/move events that may disrupt or manipulate mounted SMB sessions.

Why it matters to the business

Systems using Linux CIFS/SMB client mounts are at risk if untrusted local users, compromised low-privilege accounts, or containerized workloads can run code on the same host or network namespace. The primary business risk is theft of SMB credentials, which can enable lateral movement to file shares and Windows infrastructure, plus disruption of applications that depend on mounted SMB shares. This is not known to be exploited in the wild, is not in the CISA KEV catalog, and currently has low EPSS, but the CVSS impact is high because successful local exploitation can compromise confidentiality, integrity, and availability of SMB-mounted data.

How an attack unfolds

An attacker first needs local code execution as a non-root user on a Linux system that has the CIFS/SMB client and witness functionality in use. The attacker interacts directly with the generic netlink CIFS witness family. In the vulnerable kernel, the attacker can subscribe to the CIFS SWN multicast group without administrative network capability and passively receive witness registration messages, potentially including NTLM SMB credentials. The attacker can also send forged witness notifications, such as RESOURCE_CHANGE or CLIENT_MOVE, to the kernel CIFS witness handler. Those forged events may cause CIFS clients to react as if a legitimate SMB witness service reported a failover or move, potentially disrupting access to SMB shares or influencing session behavior. The patched kernel requires CAP_NET_ADMIN for both sending SWN_NOTIFY commands and joining the SWN multicast group, blocking this path for ordinary users.

How to fix it

Upgrade the Linux kernel to a vendor release that includes the CIFS client fix requiring GENL_ADMIN_PERM for CIFS_GENL_CMD_SWN_NOTIFY and GENL_MCAST_CAP_NET_ADMIN for the CIFS_GENL_MCGRP_SWN multicast group. Because no specific fixed package versions were provided in the advisory input, use the fixed kernel versions published by the relevant Linux distribution or appliance vendor and confirm the changelog references the CIFS witness netlink permission fix. After patching, reboot into the fixed kernel where required. As interim mitigation, reduce exposure by limiting local shell access, restricting untrusted containers or users from hosts with CIFS mounts, avoiding NTLM-authenticated SMB mounts where possible, preferring Kerberos-based SMB authentication, disabling or avoiding CIFS witness functionality if not required, and protecting any SMB credentials used by mount helpers or services.

How to confirm the fix worked

Confirm the running kernel, not just the installed package, contains the fix. Validate through vendor advisory status, kernel package changelog, or source inspection showing CAP_NET_ADMIN enforcement for CIFS SWN notify operations and the CIFS SWN multicast group. Functionally test from an unprivileged account: attempts to join the CIFS SWN multicast group or send CIFS SWN notify commands should fail with a permission error such as EPERM. Also verify SMB/CIFS mounts continue to operate normally after rebooting into the fixed kernel. For exposure assessment, identify Linux hosts with loaded CIFS modules, active CIFS mounts, or cifs.witness usage, then prioritize shared multi-user systems, build hosts, VDI systems, and container hosts where untrusted local code may run.

Typical attack path

1. Obtain local low-privilege access to a Linux host that uses CIFS/SMB client mounts.
2. Check whether the kernel exposes the CIFS witness generic netlink family and multicast group.
3. Join the CIFS_GENL_MCGRP_SWN multicast group as an unprivileged user on a vulnerable kernel.
4. Collect witness registration messages and inspect them for SMB session attributes such as username, domain, and NTLM password-related fields.
5. Optionally send forged CIFS_GENL_CMD_SWN_NOTIFY messages such as RESOURCE_CHANGE or CLIENT_MOVE to the kernel witness handler.
6. Use disclosed SMB credentials for access to file shares or lateral movement, or use forged notifications to disrupt SMB-mounted workloads.

How to detect it

Retrospective detection is difficult because generic netlink messages to the kernel are not commonly logged by default. Focus on hosts with CIFS mounts and local untrusted execution. Review auditd, eBPF, endpoint telemetry, shell history, process execution logs, and container runtime logs for non-administrative processes probing generic netlink families, subscribing to CIFS witness multicast groups, or using custom netlink tooling. Investigate unexpected access to SMB shares shortly after local activity on Linux CIFS clients, especially where NTLM credentials were used. Look for unusual CIFS reconnects, failover-like behavior, resource-change/client-move events, or application errors involving SMB-mounted paths. If enhanced telemetry is available, hunt for unprivileged processes opening NETLINK_GENERIC sockets and communicating with CIFS witness commands. Also review whether any non-root process other than the legitimate cifs.witness helper interacted with CIFS SWN functionality before patching.

• CIFS_GENL_CMD_SWN_NOTIFY
• CIFS_GENL_MCGRP_SWN
• CIFS_GENL_MCGRP_SWN_NAME
• CIFS_GENL_NAME
• cifs.witness
• RESOURCE_CHANGE
• CLIENT_MOVE
• NETLINK_GENERIC
• genl_ctrl_resolve
• /proc/fs/cifs
• /proc/fs/cifs/DebugData
• mount.cifs

What your security team should do

• Inventory Linux systems using CIFS/SMB mounts, especially those with untrusted local users or containers.
• Prioritize kernel updates for multi-user servers, application servers with SMB-mounted data paths, and systems using NTLM-authenticated CIFS mounts.
• Reboot systems after kernel update and confirm the fixed kernel is running.
• Review whether NTLM authentication is necessary for SMB mounts; migrate to Kerberos or stronger managed authentication where feasible.
• Hunt for unusual local processes interacting with generic netlink CIFS witness functionality or unexpected processes running alongside CIFS-mounted workloads.
• Restrict local access and container co-tenancy on systems with sensitive SMB mounts until patched.
• Monitor vendor advisories for exact fixed kernel versions because this issue is not currently listed as KEV and may be remediated through normal distribution kernel channels rather than emergency out-of-band releases.