[CLSA-2026:1793167137] Fix CVE(s): CVE-2026-104715
Type:
security
Severity:
Important
Release date:
2026-10-28 05:59:07 UTC
Description:
* SECURITY UPDATE: local privilege escalation via mount option injection in mount.cifs - debian/patches/CVE-2026-104715.patch: in mount.cifs.c, reject username and domain values containing ",", "=", CR or LF when they come from a credentials file, the USER environment variable or the passwd database, and guard against getusername() returning NULL. - CVE-2026-104715
CVEs fixed:
Updated packages:
  • cifs-utils_6.11-3.1+deb11u2+tuxcare.els2_amd64.deb
    sha:806505e87ea0221a2276840ea9da8b5694b73972
  • cifs-utils_6.11-3.1+deb11u2+tuxcare.els2_arm64.deb
    sha:1f5fe1bb5735133f431ccfca437b49471cf0fb9d
  • cifs-utils_6.11-3.1+deb11u2+tuxcare.els2_armel.deb
    sha:5ea811747cc539500dda85d1d486b9fa7b3e623a
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.