CIFSwitch LPE (CVE‑2026‑46243) Lets Unprivileged Users Gain Root on Many Linux Distros
Researcher Asim Manizada disclosed CIFSwitch, a logic flaw in the Linux kernel’s CIFS client that lets an unprivileged process forge a cifs.spnego key request. The bug, present since 2007, triggers a privileged upcall and grants root on a range of distributions. A patch and mitigations are now available.