CVE-2025-2312: cifs.upcall makes an upcall to the wrong namespace in containerized environments

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-25 · updated 2026-06-17
Weakness: CWE-488

Description

A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache.

Affected products

cifs-utils: before 7.2 — fixed in 7.2

How to fix

Upgrade to a fixed version: cifs-utils 7.2. Check the vendor advisory for mitigations.

References

https://git.samba.org/?p=cifs-utils.git;a=commit;h=89b679228cc1be9739d54203d28289b03352c174
https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/smb?id=db363b0a1d9e6b9dc556296f1b1007aeb496a8cf

Get alerted when CVE-2025-2312 or the next vulnerability affects your stack