QSN-8938-1: cifs-utils vulnerability
2026-10-19

Summary:
cifs-utils could be made to run programs as an administrator.

Details:
It was discovered that cifs-utils incorrectly handled credentials files
used by privileged mount.cifs invocations. A local attacker could
possibly use this issue to inject arbitrary mount options into a
privileged mount, resulting in a privilege escalation.

Affected QuantaStor releases:
  6.9.1.001 jammy: cifs-utils 2:6.14-1ubuntu0.7 (fixed in 2:6.14-1ubuntu0.7)
  6.9.0.464 jammy: cifs-utils 2:6.14-1ubuntu0.6 (fixed in 2:6.14-1ubuntu0.7)
  6.8.6.015 jammy: cifs-utils 2:6.14-1ubuntu0.6 (fixed in 2:6.14-1ubuntu0.7)
  6.8.5.018 jammy: cifs-utils 2:6.14-1ubuntu0.6 (fixed in 2:6.14-1ubuntu0.7)
  6.8.4.038 jammy: cifs-utils 2:6.14-1ubuntu0.6 (fixed in 2:6.14-1ubuntu0.7)
  6.8.3.018 jammy: cifs-utils 2:6.14-1ubuntu0.6 (fixed in 2:6.14-1ubuntu0.7)
  6.8.2.002 jammy: cifs-utils 2:6.14-1ubuntu0.6 (fixed in 2:6.14-1ubuntu0.7)
  6.8.1.007 jammy: cifs-utils 2:6.14-1ubuntu0.6 (fixed in 2:6.14-1ubuntu0.7)
  6.8.0.205 jammy: cifs-utils 2:6.14-1ubuntu0.3 (fixed in 2:6.14-1ubuntu0.7)

CVEs: CVE-2026-104715

References:
  https://ubuntu.com/security/notices/USN-8938-1