Linux CVE-2026-23282

The vulnerability resides in the Linux kernel's CIFS/SMB2 client implementation (cpe:2.3:a:linux:linux), specifically in the file handling routines for SMB protocol operations. The root cause is an uninitialized local variable (CWE-456: Missing Initialization with Hard-Coded Network Resource Configuration Elements, or similar uninitialized variable class) in the smb2_unlink() function. When SMB2_open_init() or SMB2_close_init() fails during network reconnection scenarios, the @open_iov and @close_iov variables remain uninitialized but are subsequently passed to cleanup and utility functions (@rqst structures). These cleanup operations dereference memory that was never properly initialized, leading to kernel panic. The SMB2 protocol implementation is critical infrastructure for Windows file share access on Linux systems.