SB2026072088 - Improper access control in Linux kernel smb client

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072088

SB2026072088 - Improper access control in Linux kernel smb client

Published: July 20, 2026

Security Bulletin ID SB2026072088
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper access control (CVE-ID: CVE-2026-64137)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in the CIFS SWN generic netlink multicast group when joining the multicast group and receiving registration messages. A local user can join the CIFS_GENL_MCGRP_SWN group to disclose sensitive information.

For NTLM-authenticated mounts, exposed registration messages may include the username, domain, and password attributes copied from the CIFS session.


Remediation

Install update from vendor's website.

References