cifs-utils on Ubuntu: local flaw leads to root, patch for four releases

Canonical released today, 19 October 2026, advisory USN-8938-1 for a vulnerability in cifs-utils, the package that handles mounting CIFS/SMB shares on Linux. Anyone running Ubuntu servers with network storage mounted via SMB must update: the flaw allows an unprivileged local user to achieve root access.

The issue

According to the official advisory, an unprivileged user can control a CIFS credentials file used by a privileged invocation of mount.cifs, and the value read from the file is copied into the mount options string without validation. As a result, mount options controlled by the attacker can be injected into the privileged mount. This results in local privilege escalation.

The assigned CVE is CVE-2026-104715, with a CVSS 3.1 score of 7.8 (High), CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: local attack, low complexity, no user interaction required.

A public proof-of-concept describes the mechanism in detail: the open_cred_file() function in mount.cifs copies the username= value from a credentials file into the mount options string intended for the kernel without tokenising commas, and the value arrives after mount.cifs's per-token sanitiser has already passed, so injected options like uid=0,forceuid,file_mode=04755 go straight through to the kernel. Notification to the maintainer dates from 23 September 2026, with confirmation of the root shell variant and SELinux bypass on 28 September, reproduction on Kali 2026.3 on 10 October, and public disclosure on 15 October 2026.

Patched packages

Ubuntu Release	cifs-utils patched version
26.10 (stonking)	2:7.4-1ubuntu3.1
26.04 LTS (resolute)	2:7.4-1ubuntu0.26.04.4
24.04 LTS (noble)	2:7.0-2ubuntu0.6
22.04 LTS (jammy)	2:6.14-1ubuntu0.7

A standard system update (apt update && apt upgrade) applies the patched versions. The same flaw has been patched on other distributions as well: Red Hat Enterprise Linux, SUSE Linux Micro 6.0 and Amazon Linux issued separate advisories within the same timeframe, indicating that the bug affects upstream cifs-utils code rather than a Ubuntu-specific build.

Who should prioritise checking: any multi-user server mounting SMB/CIFS shares via credentials readable by non-administrator users—a common condition on shared VPS and environments with multiple system accounts.