Linux Kernel EUVD-2026-86188

Requires the Linux cifs/SMB client (cifs.ko) to be in use and a victim to mount and operate on an SMB share whose server responses leave cifs_open_info_data fields unpopulated - realistically a malicious or misbehaving SMB server. Exploitation is limited by high attack complexity (AC:H), the need for some local privilege (PR:L) to trigger the affected file operations, and the fact that the impact is uninitialized/stale stack data rather than attacker-controlled memory. Only unpatched kernels prior to 6.12.111/6.18.53/7.2 are affected.

This is a low-real-world-priority defect despite its 7.0 CVSS. The root cause is a stack-allocated cifs_open_info_data struct that is not zero-initialized, so fields not populated by a given code path retain residual stack contents - a use-of-uninitialized-memory bug (CWE-457/908), not a classic exploitable corruption. The provided CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) already reflects meaningful friction (local vector, high complexity, some privilege), and the C:H/I:H/A:H impact triple looks inflated for a bug whose worst realistic outcome is incorrect file metadata or a minor stale-stack disclosure rather than full memory-safety compromise. There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so exploitation signals are entirely absent. Note a tension worth flagging: the CVSS vector says AV:L (local), but the affected struct is populated from SMB server responses, so the practical trigger involves a controlled/malicious SMB server plus a victim performing file operations - verify the intended attack surface with the maintainers. Overall: patch during normal kernel update cycles, not an emergency.

A user mounts an SMB/CIFS share from an attacker-controlled or malicious server, or from a server that returns responses omitting certain fields. The kernel's cifs client parses the response into an uninitialized stack cifs_open_info_data struct, leaving some fields populated with stale kernel stack data, which then propagates as wrong file metadata or potentially leaks residual stack contents. No public exploit code is identified at time of analysis, and high attack complexity (AC:H) makes reliable weaponization unlikely.