What happened
In the Linux kernel, the following vulnerability has been resolved: smb/client: zero-initialize stack-allocated cifs_open_info_data Stack-allocated cifs_open_info_data may contain random data. This can make some fields have wrong value if they are not set later.
Affected versions
Linux: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 through before 74ff47e6c4213fcfeba2de448d9cbda200507d22 (git); 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 through before 22532dd88694ed20bdd47523ffa709f166ce776b (git); 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 through before 8fce4cf4369c766a3293a05419500cbfde72e60d (git); before 6.12.111 (semver); before 6.18.53 (semver) Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.
Public PoC references
No public PoC reference has passed the current publication threshold.