In the Linux kernel, the following vulnerability has been resolved: smb: client: require net admin for CIFS SWN netlink CIFS_GENL_CMD_SWN_NOTIFY is the userspace witness-notify command. The intended sender is the cifs.witness helper, but the generic-netlink operation currently has no capability flag, so any local process can send RESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness handler. The same family exposes CIFS_GENL_MCGRP_SWN without multicast-group capability flags. Register messages sent to that group include the witness registration id and, for NTLM-authenticated mounts, the username, domain, and password attributes copied from the CIFS session. An unprivileged local process should not be able to join that group and receive those messages. Require CAP_NET_ADMIN for incoming SWN_NOTIFY commands with GENL_ADMIN_PERM, and require CAP_NET_ADMIN over the network namespace for joining the SWN multicast group with GENL_MCAST_CAP_NET_ADMIN. The cifs.witness service runs with the privileges needed for both operations.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - smb: client: require net admin for CIFS SWN netlink CIFS_GENL_CMD_SWN_NOTIFY is the userspace witness-     notify command. The intended sender is the cifs.witness helper, but the generic-netlink operation     currently has no capability flag, so any local process can send RESOURCE_CHANGE or CLIENT_MOVE     notifications to the in-kernel witness handler. The same family exposes CIFS_GENL_MCGRP_SWN without     multicast-group capability flags. Register messages sent to that group include the witness registration id     and, for NTLM-authenticated mounts, the username, domain, and password attributes copied from the CIFS     session. An unprivileged local process should not be able to join that group and receive those messages.
    Require CAP_NET_ADMIN for incoming SWN_NOTIFY commands with GENL_ADMIN_PERM, and require CAP_NET_ADMIN     over the network namespace for joining the SWN multicast group with GENL_MCAST_CAP_NET_ADMIN. The     cifs.witness service runs with the privileges needed for both operations. (CVE-2026-64137)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
333944	Photon OS 5.0: Linux PHSA-2026-5.0-92-0864	Nessus	PhotonOS Local Security Checks	Local	high
333941	Photon OS 5.0: Linux PHSA-2026-5.0-92-0926	Nessus	PhotonOS Local Security Checks	Local	high
329326	Photon OS 5.0: Linux PHSA-2026-5.0-0926	Nessus	PhotonOS Local Security Checks	Local	high
328499	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2026-110 (ALASKERNEL-5.15-2026-110)	Nessus	Amazon Linux Local Security Checks	Local	medium
328078	Linux Distros Unpatched Vulnerability : CVE-2026-64137	Nessus	Misc.	Local	high
318773	Photon OS 5.0: Linux PHSA-2026-5.0-0864	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2026-64137

high

Tenable Plugins

high

high

high

high

high

medium

high

high