The Linux kernel validated cifs.spnego key descriptions as if they were created within the CIFS subsystem, but the key fields such as pid, uid, creduid, and upcall_target can be supplied by userspace via request_key(2) or add_key(2). Because the kernel treats these fields as kernel‑originating inputs, an attacker who can create a cifs.spnego key can inject arbitrary authority information and potentially gain elevated privileges or bypass permission checks. This vulnerability involves improper input validation (CWE‑20) and improper authority handling (CWE‑825), and may lead to kernel‑level privilege escalation.

The vulnerability affects the Linux kernel broadly; the specific affected vendor and product list includes generic Linux:Linux kernel releases. No fixed version is listed, so kernel versions before the patch that introduced this fix are considered vulnerable.

The CVSS score is 7.1, indicating a high severity flaw. The EPSS score is less than 1%, indicating a very low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. The attack vector is likely local or through privileged user accounts that can create keys. An attacker could exploit the vulnerability to gain root or otherwise alter keyring data that the kernel trusts, thereby escalating privileges.