{"uuid": "0d81ff29-70a0-4b85-8e8c-738af0c2ffd2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46243", "type": "published-proof-of-concept", "source": "https://t.me/cve0day/472", "content": "CVE-2026-46243\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject userspace cifs.spnego descriptions\n\ncifs.spnego key descriptions contain authority-bearing fields such as\npid, uid, creduid, and upcalltarget that cifs.upcall treats as\nkernel-originating inputs. However, userspace can also create keys of\nthis type through requestkey(2) or addkey(2), allowing those fields to\nbe supplied without CIFS origin.\n\nOnly accept cifs.spnego descriptions while CIFS is using its private\nspnegocred to request the key.", "creation_timestamp": "2026-08-28T00:00:38.552817Z"}