Verified 2026-06-08 on Ubuntu 24.04.4 / kernel 6.8.0-117-generic under
QEMU/HVF (offline: cloud image + payload iso, no guest networking):
- modprobe cifs registers the cifs.spnego key type (cifs-utils not needed
to reach the primitive).
- Independent python3 ctypes add_key('cifs.spnego', forged
uid/creduid/upcall_target) ACCEPTED (user-key control also accepted);
module exploit() independently reported 'primitive CONFIRMED' then the
honest EXPLOIT_FAIL.
- detect() returned PRECOND_FAIL without cifs-utils and VULNERABLE under
SKELETONKEY_CIFS_ASSUME_PRESENT=1.
Still pending (so cifswitch stays 🟡 and is NOT counted as a verified
end-to-end CVE; verified count stays 28 of 37): a patched kernel
(>=6.12.90/7.0.10) to prove add_key is REJECTED there (probe discriminates
fixed-from-vulnerable), and the full namespace+NSS root-pop. Recorded in
NOTICE.md, CVES.md, RELEASE_NOTES.md, and tools/verify-vm/targets.yaml.
KaraZajac
050731396d