CVE-2026-23282: Linux Kernel SMB Client Vulnerability

CVE-2026-23282 Overview

CVE-2026-23282 is a Linux kernel vulnerability in the SMB client subsystem. The flaw resides in smb2_unlink() where uninitialized iovec structures can trigger a kernel oops. When SMB2_open_init() or SMB2_close_init() fails, typically during a reconnect scenario, the iovs set in @rqst remain uninitialized. Subsequent calls to SMB2_open_free(), SMB2_close_free(), or smb2_set_related() operate on this uninitialized memory and crash the kernel. The fix initialises @close_iov and @open_iov before assigning them to @rqst. The issue affects systems mounting remote SMB shares using the in-kernel CIFS/SMB client.

Critical Impact
An uninitialized variable use in the SMB client can cause a kernel oops during SMB reconnect, resulting in denial of service for systems with mounted SMB shares.

Affected Products

Linux kernel SMB client (fs/smb/client)
Distributions shipping affected stable kernel branches prior to the patch commits
Systems mounting remote shares via the in-kernel CIFS/SMB2 client

Discovery Timeline

2026-03-25 - CVE-2026-23282 published to NVD
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23282

Vulnerability Analysis

The vulnerability is an uninitialized memory use in the Linux kernel SMB2 client unlink path. In smb2_unlink(), the code constructs a compound request consisting of an open, an operation, and a close. Each sub-request uses local iovec arrays referenced by the smb_rqst structure via the rq_iov pointer.

When SMB2_open_init() or SMB2_close_init() returns an error, for example during a session reconnect, the code path skips the normal initialization of the iov arrays. The cleanup logic still invokes SMB2_open_free(), SMB2_close_free(), or smb2_set_related() on the partially constructed request. Those helpers dereference rq_iov entries that contain stack garbage, producing a kernel oops [CWE-457].

The upstream fix zero-initialises @close_iov and @open_iov before binding them to the request structures, so cleanup operations encounter well-defined empty buffers rather than uninitialized stack content.

Root Cause

The root cause is missing initialization of stack-allocated iovec arrays before they are referenced through rqst[].rq_iov. The error-handling path assumes the arrays were populated by SMB2_open_init() or SMB2_close_init(), but a failure leaves them in an indeterminate state.

Attack Vector

Triggering the oops requires conditions that cause SMB2_open_init() or SMB2_close_init() to fail during an unlink operation, such as an SMB session reconnect. A malicious or unstable SMB server able to influence reconnect behavior on a connected client could repeatedly induce the failure. The result is a kernel crash on the client, producing local denial of service. The vulnerability does not provide code execution or privilege escalation primitives based on the published fix.

No public proof-of-concept code is available. Refer to the upstream commits for technical details: Kernel commit 048efe129a29, Kernel commit 86163b98891a, and Kernel commit dc710c87af33.

Detection Methods for CVE-2026-23282

Indicators of Compromise

Kernel oops messages referencing smb2_unlink, SMB2_open_free, SMB2_close_free, or smb2_set_related in dmesg or /var/log/kern.log.
Repeated SMB client reconnect events in kernel logs immediately preceding a crash.
Unexpected reboots or hung tasks on hosts with active CIFS/SMB mounts.

Detection Strategies

Monitor kernel ring buffer and journal logs for oops traces involving the cifs or smb modules.
Correlate SMB session reconnect events with subsequent process or system instability on clients.
Track running kernel versions across the fleet and flag hosts that have not received the stable backport of the fix.

Monitoring Recommendations

Forward kern.log and syslog to a centralized logging platform with alerts on Oops, BUG:, or general protection fault strings tied to SMB symbols.
Inventory systems mounting SMB shares and prioritize them for kernel version monitoring.
Alert on abnormal SMB reconnect frequency from clients to detect server-side instability that could trigger the bug.

How to Mitigate CVE-2026-23282

Immediate Actions Required

Apply the stable kernel update containing the patch commits to all affected systems.
Inventory hosts mounting SMB shares and prioritize them in the patch rollout.
Restrict SMB client connections to trusted, stable file servers until patching completes.

Patch Information

The vulnerability is fixed by initialising @close_iov and @open_iov in smb2_unlink() before assigning them to the request structures. The fix is available in stable kernel commits 048efe129a29, 86163b98891a, and dc710c87af33. Apply the corresponding stable release from your distribution vendor.

Workarounds

Avoid mounting SMB shares from servers known to cause frequent session reconnects.
Unmount non-essential SMB shares on critical hosts until the patched kernel is deployed.
Where possible, use alternative file access protocols on systems that cannot be promptly updated.

bash

# Verify current kernel version and check for the fix
uname -r

# On Debian/Ubuntu, install the latest kernel update
sudo apt update && sudo apt upgrade linux-image-$(uname -r | cut -d- -f3-)

# On RHEL/CentOS/Fedora
sudo dnf update kernel

# Reboot to load the patched kernel
sudo reboot