Executive brief
A vulnerability in the Linux kernel's SMB client could allow a local user to cause a system crash. The issue occurs when the system attempts to delete files over a network share and encounters a connection failure. This results in a 'kernel oops' (a serious system error), which can lead to a complete system hang or reboot, impacting the availability of the affected machine.
Technical details
A vulnerability classified as CWE-908 (Use of Uninitialized Resource) exists in the Linux kernel's smb2_unlink() function within fs/smb/client/smb2inode.c. If SMB2_open_init() or SMB2_close_init() fails (for example, during a network reconnection), the I/O vectors (iovs) associated with the request are left uninitialized. Subsequent calls to cleanup functions like SMB2_open_free() or smb2_set_related() on these uninitialized variables trigger a kernel oops. This is a local attack vector requiring low privileges, resulting in a denial of service (system crash). Patches have been released for various stable kernel branches including 6.18.y, 6.19.y, and the 7.0 development cycle.
Affected products
- Linux Linux Kernel 6.17.1 to 6.18.17, 6.19 to 6.19.7, 7.0-rc1, 7.0-rc2
Timeline
- 2026-03-05: patched: Initial patch committed to mainline kernel tree
- 2026-03-25: disclosed: CVE published by kernel.org
- 2026-05-21: advisory: NIST NVD analysis completed