CVE-2026-23303
Information Disclosure in Linux Kernel SMB Client via Debug Logging
Publication date: 2026-03-25
Last updated on: 2026-04-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's SMB client component. Specifically, when debug logging is enabled, the function cifs_set_cifscreds() logs the key payload, which includes plaintext usernames and passwords. This means sensitive credential information is exposed in the logs, potentially allowing unauthorized access to these credentials.
How can this vulnerability impact me? :
The impact of this vulnerability is that sensitive credentials such as usernames and passwords can be exposed in plaintext within debug logs. If an attacker gains access to these logs, they could retrieve these credentials and use them to compromise systems or escalate privileges.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, disable debug logging for the cifs_set_cifscreds function to prevent plaintext credentials from being logged.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves the logging of plaintext credentials (username and password) when debug logging is enabled in the Linux kernel's SMB client. Exposing plaintext credentials in logs can lead to unauthorized access to sensitive information.
Such exposure of sensitive authentication data could potentially violate data protection standards and regulations like GDPR and HIPAA, which require the protection of personal and sensitive information from unauthorized disclosure.
By removing the debug log that exposes plaintext credentials, the vulnerability fix helps maintain compliance with these standards by reducing the risk of credential leakage.