CVE-2026-23282

MediumCVSS 5.5/10Last modified Nov 5, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix oops due to uninitialised var in smb2_unlink()

If SMB2_open_init() or SMB2_close_init() fails (e.g. reconnect), the iovs set @rqst will be left uninitialised, hence calling SMB2_open_free(), SMB2_close_free() or smb2_set_related() on them will oops.

Fix this by initialising @close_iov and @open_iov before setting them in @rqst.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-908

Affected software

VendorProductVersions
LinuxLinux>= 1cf9f2a6a544288516a7b9e883a48eba6246bcf2, < 86163b98891aa9800f6103252e5acc7bb98afb91; >= 1cf9f2a6a544288516a7b9e883a48eba6246bcf2, < dc710c87af3341554d02d634ada1d2036c49a94a; >= 1cf9f2a6a544288516a7b9e883a48eba6246bcf2, < 048efe129a297256d3c2088cf8d79515ff5ec864
LinuxLinux6.17

References

Timeline

Published
Mar 25, 2026
Last modified
Nov 5, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-232835.5In the Linux kernel, the following vulnerability has been resolved: regulator: fp9931: Fix PM runtime reference leak in fp9931_hwmon_read()CVE-2026-232845.5In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of errorCVE-2026-232855.5In the Linux kernel, the following vulnerability has been resolved: drbd: fix null-pointer dereference on local read error In drbd_requestCVE-2026-232865.5In the Linux kernel, the following vulnerability has been resolved: atm: lec: fix null-ptr-deref in lec_arp_clear_vccs syzkaller reported CVE-2026-232875.5In the Linux kernel, the following vulnerability has been resolved: irqchip/sifive-plic: Fix frozen interrupt due to affinity setting PLICCVE-2026-232887.8In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix out-of-bounds memset in command slot handling The rCVE-2026-232895.5In the Linux kernel, the following vulnerability has been resolved: IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() Fix CVE-2026-23299.8An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can CVE-2026-232905.5In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: validate USB endpoints The pegasus driver should vaCVE-2026-232915.5In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: properly drop the usb interface reference on disconnect WhCVE-2026-232925.5In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix recursive locking in __configfs_open_file() In flushCVE-2026-232935.5In the Linux kernel, the following vulnerability has been resolved: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled When boo
CVE-2026-23282: Medium severity, CVSS 5.5 | Vulnix