CVE-2026-64137
smb: client: require net admin for CIFS SWN netlink
Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: require net admin for CIFS SWN netlink CIFS_GENL_CMD_SWN_NOTIFY is the userspace witness-notify command. The intended sender is the cifs.witness helper, but the generic-netlink operation currently has no capability flag, so any local process can send RESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness handler. The same family exposes CIFS_GENL_MCGRP_SWN without multicast-group capability flags. Register messages sent to that group include the witness registration id and, for NTLM-authenticated mounts, the username, domain, and password attributes copied from the CIFS session. An unprivileged local process should not be able to join that group and receive those messages. Require CAP_NET_ADMIN for incoming SWN_NOTIFY commands with GENL_ADMIN_PERM, and require CAP_NET_ADMIN over the network namespace for joining the SWN multicast group with GENL_MCAST_CAP_NET_ADMIN. The cifs.witness service runs with the privileges needed for both operations.
INFO
Published Date :
July 19, 2026, 4:17 p.m.
Last Modified :
July 19, 2026, 4:17 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-64137
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Apply the Linux kernel patch.
- Ensure cifs.witness service has CAP_NET_ADMIN.
- Restrict local process access to SWN netlink.
- Control network namespace access for multicast.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-64137.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-64137 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-64137
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-64137 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-64137 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'fed979a7e082bd9f25f9002c3c4f8740dacd0bc8', 'lessThan': '9cf7eb8919344932f909b2fac76296f7656fda8d', 'versionType': 'git'}, {'status': 'affected', 'version': 'fed979a7e082bd9f25f9002c3c4f8740dacd0bc8', 'lessThan': '9919021a3b7974ae66a5f9915e3a48c10cfd409b', 'versionType': 'git'}, {'status': 'affected', 'version': 'fed979a7e082bd9f25f9002c3c4f8740dacd0bc8', 'lessThan': '969bc6370334a5b4720c5470783295d6484bbc95', 'versionType': 'git'}, {'status': 'affected', 'version': 'fed979a7e082bd9f25f9002c3c4f8740dacd0bc8', 'lessThan': 'a3238b09c58f323e40743ce174cd0ab81b5c09ed', 'versionType': 'git'}, {'status': 'affected', 'version': 'fed979a7e082bd9f25f9002c3c4f8740dacd0bc8', 'lessThan': 'a8d17d22db591099519a89f14dd24810daba74c3', 'versionType': 'git'}, {'status': 'affected', 'version': 'fed979a7e082bd9f25f9002c3c4f8740dacd0bc8', 'lessThan': 'c2397b93fbb6f44a788fff30f99be2c20cc5e50f', 'versionType': 'git'}, {'status': 'affected', 'version': 'fed979a7e082bd9f25f9002c3c4f8740dacd0bc8', 'lessThan': 'd1ebfce2c1d161186a82e77590bf7da2ea1bce91', 'versionType': 'git'}], 'programFiles': ['fs/smb/client/netlink.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.11'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.11', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.15.210', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.92', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.34', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.11', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/smb/client/netlink.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: smb: client: require net admin for CIFS SWN netlink CIFS_GENL_CMD_SWN_NOTIFY is the userspace witness-notify command. The intended sender is the cifs.witness helper, but the generic-netlink operation currently has no capability flag, so any local process can send RESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness handler. The same family exposes CIFS_GENL_MCGRP_SWN without multicast-group capability flags. Register messages sent to that group include the witness registration id and, for NTLM-authenticated mounts, the username, domain, and password attributes copied from the CIFS session. An unprivileged local process should not be able to join that group and receive those messages. Require CAP_NET_ADMIN for incoming SWN_NOTIFY commands with GENL_ADMIN_PERM, and require CAP_NET_ADMIN over the network namespace for joining the SWN multicast group with GENL_MCAST_CAP_NET_ADMIN. The cifs.witness service runs with the privileges needed for both operations. Added Reference https://git.kernel.org/stable/c/969bc6370334a5b4720c5470783295d6484bbc95 Added Reference https://git.kernel.org/stable/c/9919021a3b7974ae66a5f9915e3a48c10cfd409b Added Reference https://git.kernel.org/stable/c/9cf7eb8919344932f909b2fac76296f7656fda8d Added Reference https://git.kernel.org/stable/c/a3238b09c58f323e40743ce174cd0ab81b5c09ed Added Reference https://git.kernel.org/stable/c/a8d17d22db591099519a89f14dd24810daba74c3 Added Reference https://git.kernel.org/stable/c/c2397b93fbb6f44a788fff30f99be2c20cc5e50f Added Reference https://git.kernel.org/stable/c/d1ebfce2c1d161186a82e77590bf7da2ea1bce91