---
id: CVE-2026-23282
title: 'smb: client: fix oops due to uninitialised var in smb2_unlink()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: fix oops due to uninitialised var in smb2_unlink()

  If SMB2_open_init() or SMB2_close_init() fails (e.g. reconnect), the
  iovs set @rqst will be left uninit…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1cf9f2a6a544288516a7b9e883a48eba6246bcf2 <
    86163b98891aa9800f6103252e5acc7bb98afb91
  - >-
    Linux >= 1cf9f2a6a544288516a7b9e883a48eba6246bcf2 <
    dc710c87af3341554d02d634ada1d2036c49a94a
  - >-
    Linux >= 1cf9f2a6a544288516a7b9e883a48eba6246bcf2 <
    048efe129a297256d3c2088cf8d79515ff5ec864
  - Linux 6.17
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:24:56.090540Z'
published: '2026-03-25'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:33:35.280Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23282'
references:
  - url: 'https://git.kernel.org/stable/c/86163b98891aa9800f6103252e5acc7bb98afb91'
  - url: 'https://git.kernel.org/stable/c/dc710c87af3341554d02d634ada1d2036c49a94a'
  - url: 'https://git.kernel.org/stable/c/048efe129a297256d3c2088cf8d79515ff5ec864'
tags:
  - cve.org
epss: 0.00125
epssPercentile: 0.02252
ingestedAt: '2026-11-05T22:38:32.108Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix oops due to uninitialised var in smb2_unlink()

If SMB2_open_init() or SMB2_close_init() fails (e.g. reconnect), the
iovs set @rqst will be left uninitialised, hence calling
SMB2_open_free(), SMB2_close_free() or smb2_set_related() on them will
oops.

Fix this by initialising @close_iov and @open_iov before setting them
in @rqst.

## Affected

- `Linux >= 1cf9f2a6a544288516a7b9e883a48eba6246bcf2 < 86163b98891aa9800f6103252e5acc7bb98afb91`
- `Linux >= 1cf9f2a6a544288516a7b9e883a48eba6246bcf2 < dc710c87af3341554d02d634ada1d2036c49a94a`
- `Linux >= 1cf9f2a6a544288516a7b9e883a48eba6246bcf2 < 048efe129a297256d3c2088cf8d79515ff5ec864`
- `Linux 6.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.