CVE-2026-23282
Analyzed Analyzed - Analysis Complete
Uninitialized Variable Causes Kernel Oops in Linux SMB2 Client

Publication date: 2026-03-25

Last updated on: 2026-05-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix oops due to uninitialised var in smb2_unlink() If SMB2_open_init() or SMB2_close_init() fails (e.g. reconnect), the iovs set @rqst will be left uninitialised, hence calling SMB2_open_free(), SMB2_close_free() or smb2_set_related() on them will oops. Fix this by initialising @close_iov and @open_iov before setting them in @rqst.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-25
Last Modified
2026-05-22
Generated
2026-06-16
AI Q&A
2026-03-25
EPSS Evaluated
2026-06-15
NVD
CVE-2026-23282
EUVD
EUVD-2026-15204
Affected Vendors & Products
Showing 5 associated CPEs
Vendor Product Version / Range
linux linux_kernel 6.17
linux linux_kernel From 6.19 (inc) to 6.19.7 (exc)
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel From 6.17.1 (inc) to 6.18.17 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-908 The product uses or accesses a resource that has not been initialized.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's SMB client implementation. It occurs because certain variables related to SMB2 unlink operations are left uninitialized if specific SMB2 functions (SMB2_open_init() or SMB2_close_init()) fail, such as during a reconnect attempt. When these uninitialized variables are later used in functions like SMB2_open_free(), SMB2_close_free(), or smb2_set_related(), it causes the kernel to crash (an oops). The issue is fixed by properly initializing these variables before they are used.

Impact Analysis

This vulnerability can cause the Linux kernel to crash unexpectedly when the SMB client encounters certain failure conditions. Such crashes can lead to system instability, potential denial of service, and disruption of SMB-related network operations.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23282. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart