💩 CIFSwitch: a non-universal Linux local root vulnerability


new LPE like root issue just dropped.
CIFSwitch is actually a pretty beautiful chain:
1️⃣ unprivileged user can make cifs.spnego requests
2️⃣ kernel happily accepts them
3️⃣ /usr/sbin/cifs.upcall gets launched as root
4️⃣ attacker controls pid + namespace switching
5️⃣ root process loads attacker-controlled NSS module
6️⃣ gg -> root

the funniest part is that:
- no memory corruption
- no buffer overflow

mostly trust / logic issues between kernel <-> userspace.

affected since ~2007.
many distros exploitable out of the box depending on SELinux/AppArmor policies.

mitigations:
- patch kernel
- remove cifs-utils if unused
- disable unprivileged namespaces
- block cifs module loading

🤔also interesting: author mentions using LLM-assisted graph reasoning to find multi-step vuln chains instead of simple grep/fuzzing.
this part is probably more important long-term than the vuln itself.

https://heyitsas.im/posts/cifswitch/

#security #linux

💥 16-year-old KVM bug = VM Escape

A new guest-to-host escape vulnerability in Linux KVM https://thehackernews.com/2026/07/16-year-old-linux-kvm-flaw-lets-guest.html & https://nvd.nist.gov/vuln/detail/CVE-2026-53359

I would say it's like Spectre or Meltdown but for virtualization:
1️⃣ A malicious VM can compromise the host kernel
2️⃣ It affects Intel & AMD x86. the bug is in KVM's shadow MMU mechanism
3️⃣ The attack requires:
- root inside the guest VM
- nested virtualization enabled
4️⃣ Public PoC crashes the host. The researcher claims a private exploit achieves full guest -> host RCE.
5️⃣ The fix is one extra condition before reusing a shadow page.

#security #linux