CVE-2026-64137: smb: client: require net admin for CIFS SWN netlink

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

smb: client: require net admin for CIFS SWN netlink

CIFS_GENL_CMD_SWN_NOTIFY is the userspace witness-notify command.  The
intended sender is the cifs.witness helper, but the generic-netlink
operation currently has no capability flag, so any local process can send
RESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness
handler.

The same family exposes CIFS_GENL_MCGRP_SWN without multicast-group
capability flags.  Register messages sent to that group include the witness
registration id and, for NTLM-authenticated mounts, the username, domain,
and password attributes copied from the CIFS session.  An unprivileged
local process should not be able to join that group and receive those
messages.

Require CAP_NET_ADMIN for incoming SWN_NOTIFY commands with
GENL_ADMIN_PERM, and require CAP_NET_ADMIN over the network namespace for
joining the SWN multicast group with GENL_MCAST_CAP_NET_ADMIN.  The
cifs.witness service runs with the privileges needed for both operations.

The Linux kernel CVE team has assigned CVE-2026-64137 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.11 with commit fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 and fixed in 5.15.210 with commit 9cf7eb8919344932f909b2fac76296f7656fda8d
	Issue introduced in 5.11 with commit fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 and fixed in 6.1.176 with commit 9919021a3b7974ae66a5f9915e3a48c10cfd409b
	Issue introduced in 5.11 with commit fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 and fixed in 6.6.143 with commit 969bc6370334a5b4720c5470783295d6484bbc95
	Issue introduced in 5.11 with commit fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 and fixed in 6.12.92 with commit a3238b09c58f323e40743ce174cd0ab81b5c09ed
	Issue introduced in 5.11 with commit fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 and fixed in 6.18.34 with commit a8d17d22db591099519a89f14dd24810daba74c3
	Issue introduced in 5.11 with commit fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 and fixed in 7.0.11 with commit c2397b93fbb6f44a788fff30f99be2c20cc5e50f
	Issue introduced in 5.11 with commit fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 and fixed in 7.1 with commit d1ebfce2c1d161186a82e77590bf7da2ea1bce91

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64137
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/smb/client/netlink.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/9cf7eb8919344932f909b2fac76296f7656fda8d
	https://git.kernel.org/stable/c/9919021a3b7974ae66a5f9915e3a48c10cfd409b
	https://git.kernel.org/stable/c/969bc6370334a5b4720c5470783295d6484bbc95
	https://git.kernel.org/stable/c/a3238b09c58f323e40743ce174cd0ab81b5c09ed
	https://git.kernel.org/stable/c/a8d17d22db591099519a89f14dd24810daba74c3
	https://git.kernel.org/stable/c/c2397b93fbb6f44a788fff30f99be2c20cc5e50f
	https://git.kernel.org/stable/c/d1ebfce2c1d161186a82e77590bf7da2ea1bce91