Description

In the Linux kernel, the following vulnerability has been resolved: smb/client: zero-initialize stack-allocated cifs_open_info_data Stack-allocated cifs_open_info_data may contain random data. This can make some fields have wrong value if they are not set later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-09-24T17:17:13.017Z",
  "pubdate": "2026-09-24T17:17:13.017Z",
  "executiveSummary": "This vulnerability involves an uninitialized stack memory issue within the Linux kernel's SMB client implementation (cifs_open_info_data).\nThe vulnerability occurs because the 'cifs_open_info_data' structure is allocated on the stack without being properly zero-initialized.\nThis flaw allows sensitive information residing on the kernel stack to be inadvertently included in outgoing structures if not all fields are explicitly populated by the subsequent logic.\nThe primary impact is a potential information disclosure, where kernel stack contents—which may include pointers, sensitive data, or kernel addresses—are leaked to the SMB server or local users.\nThe vulnerability affects systems utilizing the Linux kernel CIFS client. Exploitation typically requires local user access to trigger the relevant CIFS open operations, although the disclosure scope depends on how the kernel handles and transmits the uninitialized stack memory to remote peers or userspace.\nThe risk is primarily associated with reconnaissance and bypass of kernel-level security mitigations, such as KASLR, if the leaked data contains kernel-space addresses.",
  "technicalDetails": "The root cause of this vulnerability is the improper handling of stack-allocated memory structures in the Linux kernel CIFS client. Specifically, the structure 'cifs_open_info_data' is allocated on the kernel stack without explicit zero-initialization (using memset or similar mechanisms). In the Linux kernel, stack memory is reused; if a previous kernel function utilized the same memory region, the values remain in the stack until overwritten.\nWhen the CIFS client performs an open operation, it populates specific fields within 'cifs_open_info_data'. However, if the logic flow skips assignment for certain fields, the uninitialized stack memory is consumed by the function. Depending on the subsequent use of this data—such as being copied to network buffers for transmission to an SMB server or being returned to userspace—this uninitialized memory is effectively leaked outside the kernel boundary.\nThe attack flow proceeds as follows: First, an attacker triggers a specific code path within the CIFS client that involves the initialization of 'cifs_open_info_data'. This requires the existence of a CIFS mount point. Second, because the structure lacks initialization, the kernel processes the stack-resident garbage data as if it were legitimate structure members. Third, the kernel processes this contaminated structure, potentially leaking the captured stack contents into a protocol message or a userspace system call return value.\nThis issue is particularly dangerous because the kernel stack frequently contains sensitive information, including return addresses, function pointers, and cryptographic keys. An attacker can leverage this information leak to bypass Kernel Address Space Layout Randomization (KASLR) by identifying the base address of the kernel or by observing the memory layout of neighboring kernel tasks. The vulnerability does not require complex heap manipulation; rather, it exploits the deterministic nature of stack reuse within the kernel's process context.\nThe vulnerable component is the SMB/CIFS client module (fs/cifs/). Because this structure is utilized during fundamental file system operations, the exposure is relatively broad for any system with CIFS mounts active. There are no specific privileges required beyond the ability to perform file operations on a CIFS-mounted share, which may be accessible even to unprivileged users in multi-user environments."
}