Opened 20 hours ago

Last modified 4 hours ago

#24127 new enhancement

cifs-utils-7.9

Reported by: Bruce Dubbs Owned by: SecurityAdvisory
Priority: high Milestone: 98-Security
Component: BOOK Version: git
Severity: high Keywords:
Cc:

Description

New minor version.

Change History (2)

comment:1 by Joe Locash, 5 hours ago

Owner: changed from blfs-book to Joe Locash
Status: new → assigned

comment:2 by Joe Locash, 4 hours ago

Milestone: 13.2 → 98-Security
Owner: changed from Joe Locash to SecurityAdvisory
Priority: normal → high
Severity: normal → high
Status: assigned → new 
The new version of cifs-utils 7.9 has been released and ready for download

Links

webpage: https://wiki.samba.org/index.php/LinuxCIFS_utils
tarball: https://download.samba.org/pub/linux-cifs/cifs-utils/
git: git://git.samba.org/cifs-utils.git
gitweb: http://git.samba.org/?p=cifs-utils.git;a=summary

Changes since the previous release:

0f211c3 cifs-utils: bump version to 7.9
fa0ba5a mount.cifs: validate username derived from the passwd database
d561eb9 mount.cifs: reject option delimiters in username and domain

From ​https://www.openwall.com/lists/oss-security/2026/10/16/35 

Message-ID: <CAGypqWx1S3hHNxn1OMFjKJY4r3Mj2JibFptRBDoGPwAeUoY7gA@mail.gmail.com>
Date: Fri, 16 Oct 2026 06:53:03 +0000
From: Bharath SM <bharathsm.hsk@...il.com>
To: oss-security@...ts.openwall.com
Cc: Pavel Shilovsky <piastryyy@...il.com>, Paulo Alcantara <pc@...guebit.org>, 
	Johnathan Benge <johnathanbenge@...il.com>, Shyam Prasad N <sprasad@...rosoft.com>
Subject: CVE-2026-104715: cifs-utils 4.2-7.8 mount-option injection in mount.cifs

cifs-utils 7.9 fixes a mount-option injection vulnerability in
mount.cifs that can allow local privilege escalation in affected
privileged mounting configurations.

Affected versions: cifs-utils-4.2 - cifs-utils-7.8

Users are recommended to upgrade to version cifs-utils 7.9,
which fixes the issue. Distributors can alternatively backport
the fixes.

Fixed at 12c8dbbeda. Leaving open for SA.

Note: See TracTickets for help on using tickets.