[CLSA-2026:1791334395] Fix CVE(s): CVE-2026-12505
Type:
security
Severity:
Important
Release date:
2026-10-07 11:48:38 UTC
Description:
* SECURITY UPDATE: local privilege escalation via the cifs.upcall getpwuid() lookup in the caller-controlled namespace - debian/patches/CVE-2026-12505.patch: in cifs.upcall.c, drop supplementary groups before decoding the spnego key, call getpwuid() while still on the host namespace instead of after switch_to_process_ns(), and translate the host UID/GID to the target user namespace by parsing /proc//{uid,gid}_map numerically. - CVE-2026-12505
CVEs fixed:
Updated packages:
  • cifs-utils_6.11-3.1+deb11u2+tuxcare.els1_amd64.deb
    sha:7c5172cdc6140ab64a377cc5ab4b14b5af35905a
  • cifs-utils_6.11-3.1+deb11u2+tuxcare.els1_arm64.deb
    sha:fb8d3471a75d2df780b802aa537764776bc31432
  • cifs-utils_6.11-3.1+deb11u2+tuxcare.els1_armel.deb
    sha:c98ae60488af41635b0696968bd37e25c748f52f
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.