CIFSwitch is a local privilege escalation vulnerability in the Linux kernel's CIFS subsystem that allows attackers to forge CIFS authentication key descriptions and abuse the kernel's key request mechanism. The flaw exists because the Linux kernel's CIFS subsystem fails to verify that cifs.spnego key requests originate from the kernel's CIFS client. An unprivileged user can create a forged cifs.spnego request and trigger the normal authentication workflow. The root-privileged cifs.upcall helper trusts attacker-controlled fields that it assumes were generated by the kernel. By abusing these fields to force a namespace switch and triggering a Name Service Switch (NSS) lookup before privileges are dropped, a local attacker can load a malicious NSS module and achieve root code execution. The vulnerability was introduced 19 years ago in 2007.