CVE-2026-93801 smb/client: zero-initialize stack-allocated cifs_open_info_data
An attacker could read uninitialized stack memory via the Linux kernel SMB client due to missing zero-initialization of a data structure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93801?
CVE-2026-93801 is a high-severity vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb/client: zero-initialize stack-allocated cifs_open_info_data
Stack-allocated cifs_open_info_data may contain random data. This can make some fields have wrong value if they are not set later.
Which versions are affected by CVE-2026-93801?
How do I fix CVE-2026-93801?
Apply the vendor's patch.
Is CVE-2026-93801 being exploited?
There is no known exploitation of CVE-2026-93801 in the wild and no public exploit code.
Sources
Also known as AZL-103775, BELL-CVE-2026-93801, DEBIAN-CVE-2026-93801, GHSA-r8gf-cwvf-97c5, UBUNTU-CVE-2026-93801.