{"id":"CVE-2026-64137","summary":"smb: client: require net admin for CIFS SWN netlink","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: require net admin for CIFS SWN netlink\n\nCIFS_GENL_CMD_SWN_NOTIFY is the userspace witness-notify command.  The\nintended sender is the cifs.witness helper, but the generic-netlink\noperation currently has no capability flag, so any local process can send\nRESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness\nhandler.\n\nThe same family exposes CIFS_GENL_MCGRP_SWN without multicast-group\ncapability flags.  Register messages sent to that group include the witness\nregistration id and, for NTLM-authenticated mounts, the username, domain,\nand password attributes copied from the CIFS session.  An unprivileged\nlocal process should not be able to join that group and receive those\nmessages.\n\nRequire CAP_NET_ADMIN for incoming SWN_NOTIFY commands with\nGENL_ADMIN_PERM, and require CAP_NET_ADMIN over the network namespace for\njoining the SWN multicast group with GENL_MCAST_CAP_NET_ADMIN.  The\ncifs.witness service runs with the privileges needed for both operations.","modified":"2026-07-22T03:31:54.324824884Z","published":"2026-07-19T15:40:31.045Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64137.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/969bc6370334a5b4720c5470783295d6484bbc95"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9919021a3b7974ae66a5f9915e3a48c10cfd409b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9cf7eb8919344932f909b2fac76296f7656fda8d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a3238b09c58f323e40743ce174cd0ab81b5c09ed"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a8d17d22db591099519a89f14dd24810daba74c3"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c2397b93fbb6f44a788fff30f99be2c20cc5e50f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d1ebfce2c1d161186a82e77590bf7da2ea1bce91"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64137.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64137"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"fed979a7e082bd9f25f9002c3c4f8740dacd0bc8"},{"fixed":"9cf7eb8919344932f909b2fac76296f7656fda8d"},{"fixed":"9919021a3b7974ae66a5f9915e3a48c10cfd409b"},{"fixed":"969bc6370334a5b4720c5470783295d6484bbc95"},{"fixed":"a3238b09c58f323e40743ce174cd0ab81b5c09ed"},{"fixed":"a8d17d22db591099519a89f14dd24810daba74c3"},{"fixed":"c2397b93fbb6f44a788fff30f99be2c20cc5e50f"},{"fixed":"d1ebfce2c1d161186a82e77590bf7da2ea1bce91"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-64137.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.210"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.176"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.143"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.92"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.34"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.11"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-64137.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}