A flaw in the cifs-utils package allows an unprivileged local user to elevate privileges. The vulnerability stems from the credential-file option in mount.cifs not sanitizing user-controlled values before incorporating them into mount options. By crafting a malicious credential file, an attacker can inject alternate mount options, causing the privileged service that performs the mount to change its behavior and bypass the OS’ permission checks. This enables the local user to execute binaries with root or administrative privileges and access files that should remain protected. The weakness is formally classified as CWE‑88, demonstrating a flaw in permission or privilege management.

This vulnerability affects Red Hat Enterprise Linux versions 6 through 10 and Red Hat OpenShift Container Platform 4. All affected installations rely on the cifs-utils package and may allow a local attacker to mount CIFS shares using the vulnerable credential-file handling on these platforms.

The CVSS score of 7.8 indicates a high impact local privilege escalation scenario. Although the EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog, suggesting no widely available exploit yet. However, the flaw permits direct tampering with mount options, which can be abused without network exposure or special privileges beyond local user access. The attack vector is local, requiring the attacker to log into the affected system with an unprivileged account. Once the malicious credential file is supplied, the privileged mount process will accept the injected options and the attacker gains root‑level control over the system.