AZL-89309
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-89309.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-89309
- Upstream
- Published
- 2026-06-01T17:17:34Z
- Modified
- 2026-08-28T17:47:46Z
- Summary
- CVE-2026-46243 affecting package kernel for versions less than 6.6.143.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
smb: client: reject userspace cifs.spnego descriptions
cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin.
Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key.
- References