High 7.0Published Sep 24, 2026

CVE-2026-93801smb/client: zero-initialize stack-allocated cifs_open_info_data

Updated under an hour ago (Oct 27, 2026, 2:50 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: smb/client: zero-initialize stack-allocated cifs_open_info_data Stack-allocated cifs_open_info_data may contain random data. This can make some fields have wrong value if they are not set later.

CVSS: 7.0 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	436cfdbc57d98808fce427d9a8d97691374989b3 builds before 2c5db82778f560121efda9e052e2f19c2d807c1b; from fc2f2011d3d84b56f536b4a25a4bb2fa1b13d520 before 74ff47e6c4213fcfeba2de448d9cbda200507d22; from 057ac50638bcece64b3b436d3a61b70ed6c01a34 before 22532dd88694ed20bdd47523ffa709f166ce776b; 057ac50638bcece64b3b436d3a61b70ed6c01a34 builds before 8fce4cf4369c766a3293a05419500cbfde72e60d; 83d3bc866530a36a465b47cce4d2a9def2411960; from 6.6.113 before 6.6.160; from 6.12.54 before 6.12.111; from 6.17.4 before 6.18	CNA record

References

References

https://git.kernel.org/stable/c/2c5db82778f560121efda9e052e2f19c2d807c1b
https://git.kernel.org/stable/c/74ff47e6c4213fcfeba2de448d9cbda200507d22
https://git.kernel.org/stable/c/22532dd88694ed20bdd47523ffa709f166ce776b
https://git.kernel.org/stable/c/8fce4cf4369c766a3293a05419500cbfde72e60d

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.