CVE-2026-64137

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the SMB client where the CIFS GENL CMD SWN NOTIFY userspace witness-notify command lacks a capability flag. This allows any local process to send RESOURCE CHANGE or CLIENT MOVE notifications to the in-kernel witness handler. Additionally, the CIFS GENL MCGRP SWN family lacks multicast-group capability flags, enabling unprivileged local processes to join the group and receive sensitive information, including witness registration IDs and, for NTLM-authenticated mounts, the username, domain, and password attributes from the CIFS session.

Recommendations Require CAP NET ADMIN for incoming SWN NOTIFY commands with GENL ADMIN PERM and require CAP NET ADMIN over the network namespace for joining the SWN multicast group with GENL MCAST CAP NET ADMIN.