CVE-2026-23282Access of Uninitialized Pointer in Linux

Severity
5.5MEDIUM
No vector
EPSS
0.0%
top 94.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedMar 25

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix oops due to uninitialised var in smb2_unlink() If SMB2_open_init() or SMB2_close_init() fails (e.g. reconnect), the iovs set @rqst will be left uninitialised, hence calling SMB2_open_free(), SMB2_close_free() or smb2_set_related() on them will oops. Fix this by initialising @close_iov and @open_iov before setting them in @rqst.

Affected Packages4 packages

Linuxlinux/linux_kernel6.17.06.18.17+1
Debianlinux/linux_kernel< 6.19.8-1
CVEListV5linux/linux1cf9f2a6a544288516a7b9e883a48eba6246bcf286163b98891aa9800f6103252e5acc7bb98afb91+3
debiandebian/linux< linux 6.19.8-1 (forky)

🔴Vulnerability Details

3
OSV
CVE-2026-23282: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix oops due to uninitialised var in smb2_unlink() If SMB2_open_init(2026-03-25
OSV
smb: client: fix oops due to uninitialised var in smb2_unlink()2026-03-25
GHSA
GHSA-xc6w-xcgh-jjhw: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix oops due to uninitialised var in smb2_unlink() If SMB2_open_ini2026-03-25

📋Vendor Advisories

2
Red Hat
kernel: smb: client: fix oops due to uninitialised var in smb2_unlink()2026-03-25
Debian
CVE-2026-23282: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client...2026

🕵️Threat Intelligence

1
Wiz
CVE-2026-23282 Impact, Exploitability, and Mitigation Steps | Wiz