The Linux kernel’s SMB client contains a flaw that allows a local user to send privileged netlink commands to the CIFS witness module. The witness’s notify and multicast interfaces lack required CAP_NET_ADMIN checks, so any non‑privileged process can provoke RESOURCE_CHANGE or CLIENT_MOVE notifications and join the SWN multicast group. This vulnerability is a failure to enforce proper authorization checks (CWE‑280), which allows the attacker to trigger copies from a CIFS session, enabling local privilege escalation or credential disclosure.

All Linux kernel vulnerability is present in the kernel itself, affecting all distributions that ship the unpatched kernel. No specific vendor or version string is listed; therefore any installation running is applied.

The CVSS score of 7.8 classifies this flaw as High. The EPSS score is listed as <1%, indicating that widespread exploitation is currently unlikely. The vulnerability is not recorded in CISA KEV. Attackers would need local access, but no elevated privileges are required because the enforcement checks are missing. An attacker with a regular user account can exploit the mis‑configured netlink operations to elevate privileges to the kernel or to exfiltrate credentials from CIFS mounts.