CVE-2026-12505: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-12505 is a local privilege escalation vulnerability in the cifs-utils package, specifically in the cifs.upcall helper, which fails to securely drop root privileges before performing NSS lookups in a user-controlled environment. A local, low-privileged attacker can craft a malicious request_key payload to trick the root-owned helper into entering an attacker-controlled namespace containing a malicious NSS module, ultimately executing arbitrary commands as root. The vulnerability affects cifs-utils across multiple Red Hat Enterprise Linux versions and Red Hat CoreOS (RHCOS). It was disclosed on June 16–18, 2026, with a patch commit available in the cifs-utils upstream repository. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, Github Advisory).

The root cause is classified as CWE-250 (Execution with Unnecessary Privileges): the cifs.upcall helper switches into attacker-controlled user and mount namespaces before fully dropping its root kernel credentials, then performs getpwuid() NSS lookups while still privileged (Red Hat Bugzilla). An attacker exploits this by creating a controlled namespace containing a malicious NSS configuration and shared library module, then triggering a crafted cifs.spnego key request via the request_key() kernel interface to cause cifs.upcall to load the attacker's NSS module with root privileges (Red Hat CVE, Github Advisory). The attack requires only local access and low privileges, with no user interaction needed. A fix was committed to the upstream cifs-utils git repository (cifs-utils commit).

Successful exploitation grants the attacker full root-level code execution on the affected system, resulting in complete compromise of confidentiality, integrity, and availability. An attacker can read or exfiltrate any data on the system, modify or destroy files, install persistent backdoors, and use the compromised host as a pivot point for lateral movement within the network. All systems running affected versions of cifs-utils on Red Hat Enterprise Linux or RHCOS that have the cifs.upcall helper installed are at risk (Red Hat CVE, Github Advisory).

As of the disclosure date, no public proof-of-concept exploit code or in-the-wild exploitation has been reported, and the NVD SSVC assessment confirms exploitation status as "none" (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.119% (2nd percentile), indicating a low near-term exploitation probability (Github Advisory). However, the attack complexity is low and requires only a local unprivileged account, making it a meaningful risk in multi-tenant or shared Linux environments.

1. Gain local access: Obtain a low-privileged local account on a system running a vulnerable version of cifs-utils with the cifs.upcall helper installed.
2. Create a malicious namespace: Use Linux namespace APIs (e.g., unshare or clone with CLONE_NEWUSER | CLONE_NEWNS) to create a custom user and mount namespace under attacker control.
3. Plant a malicious NSS module: Within the controlled namespace, place a crafted shared library (e.g., libnss_files.so) and a malicious /etc/nsswitch.conf that directs NSS lookups to the attacker's library, which executes arbitrary commands when called.
4. Craft a malicious cifs.spnego key request: Use the request_key() system call with a forged cifs.spnego key description to trigger cifs.upcall processing.
5. Trigger namespace entry before privilege drop: The crafted payload causes cifs.upcall (running as root) to enter the attacker-controlled namespace before dropping privileges, at which point it performs a getpwuid() NSS lookup.
6. Achieve root code execution: The malicious NSS module is loaded by the root-privileged cifs.upcall process, executing the attacker's payload with full root privileges and fully compromising the system (Red Hat Bugzilla, Github Advisory).

• Logs: Unexpected cifs.upcall invocations in system logs (/var/log/messages, journalctl) not associated with legitimate CIFS mount activity; audit log entries (/var/log/audit/audit.log) showing request_key syscalls from low-privileged users targeting cifs.spnego key types.
• Process: Unusual child processes spawned by cifs.upcall (e.g., shells, network tools like curl, wget, nc) visible in process trees; cifs.upcall processes observed entering unexpected namespaces (detectable via /proc/<pid>/ns/ inspection).
• File System: Unexpected shared library files (e.g., libnss_*.so) or nsswitch.conf files created in non-standard or temporary directories; new SUID binaries, cron jobs, or SSH authorized keys added under root-owned paths after cifs.upcall execution.
• Network: Unexpected outbound connections from the host following cifs.upcall activity, particularly to external IPs not associated with legitimate SMB/CIFS servers.

The upstream cifs-utils project has published a fix in commit 972c5b5ff95e3e812bc8daa72d0383654ab0dba7 that ensures root privileges are fully dropped before any NSS lookups are performed (cifs-utils commit). Users should update cifs-utils to a patched version once vendor packages are released for their distribution; Red Hat has tracked this via Bugzilla bug 2489805 (Red Hat Bugzilla). As a short-term workaround where CIFS/SMB mounts with Kerberos authentication are not required, consider removing or restricting access to the cifs.upcall binary (e.g., removing its setuid bit or restricting execution to privileged users only). Monitor systems for anomalous request_key activity targeting cifs.spnego keys as a detection measure.