CVE-2026-104715 — Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass

Description (CNA)

A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.

Affected (CNA)

Vendor / product	Versions
Red Hat / Red Hat Enterprise Linux 10	affected
Red Hat / Red Hat Enterprise Linux 6	unknown
Red Hat / Red Hat Enterprise Linux 7	affected
Red Hat / Red Hat Enterprise Linux 8	affected
Red Hat / Red Hat Enterprise Linux 9	affected
Red Hat / Red Hat OpenShift Container Platform 4	affected
Red Hat / Red Hat OpenShift Container Platform 4	affected

CWE

CWE-88

References

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/10/16/35

CISA-ADP

No English description supplied.

No references supplied.