Fix CVE(s): CVE-2026-104715

{
  "id": "011890a4480155a425aa97ce4762f1cdaab1487ea14a02d0a36859e5683219f0",
  "url": "https://osv.dev/vulnerability/CLSA-2026-1792790974",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Fix CVE(s): CVE-2026-104715",
    "summary": "* SECURITY UPDATE: mount option injection via credentials file values - debian/patches/CVE-2026-104715.patch: in mount.cifs.c, reject username= and domain= values from a credentials file, and the USER environment variable or passwd login name, that contain an option delimiter (comma, equals, CR or LF) before they are assembled into the kernel mount option string. - CVE-2026-104715",
    "evidence": "osv:CLSA-2026-1792790974",
    "products": [
      {
        "name": {
          "value": "cifs-utils",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2:6.8-2+deb10u1+tuxcare.els1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CLSA-2026-1792790974",
      "aliases": [
        "CLSA-2026-1792790974"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "2:6.8-2+deb10u1+tuxcare.els1"
                }
              ]
            }
          ],
          "package": {
            "name": "cifs-utils",
            "purl": "pkg:deb/tuxcare/cifs-utils?distro=debian-10",
            "ecosystem": "TuxCare:Debian:10"
          },
          "database_specific": {
            "source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1792790974.json"
          }
        }
      ],
      "modified": "2026-10-26T09:31:53.127539561Z",
      "provider": "osv",
      "upstream": [
        "CVE-2026-104715"
      ],
      "references": [
        "https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1792790974.html",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-104715"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2026-104715",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 448830,
  "published_at": "2026-10-23T21:29:45+00:00"
}