CVE-2026-23303 (GCVE-0-2026-23303)

Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-05-11 22:04
VLAI
Title
smb: client: Don't log plaintext credentials in cifs_set_cifscreds
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: Don't log plaintext credentials in cifs_set_cifscreds When debug logging is enabled, cifs_set_cifscreds() logs the key payload and exposes the plaintext username and password. Remove the debug log to avoid exposing credentials.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 8a8798a5ff90977d6459ce1d657cf8fe13a51e97 , < e5a3b11e07b335006371915b2da47b6056c9e3bc (git)
Affected: 8a8798a5ff90977d6459ce1d657cf8fe13a51e97 , < 54c570de9a35860dfa85fe668f23ddfda8cc7e26 (git)
Affected: 8a8798a5ff90977d6459ce1d657cf8fe13a51e97 , < ff0ece8ed04180c52167c003362284b23cf54e8d (git)
Affected: 8a8798a5ff90977d6459ce1d657cf8fe13a51e97 , < 3990f352bb0adc8688d0949a9c13e3110570eb61 (git)
Affected: 8a8798a5ff90977d6459ce1d657cf8fe13a51e97 , < b746a357abfb8fdb0a171d51ec5091e786d34be1 (git)
Affected: 8a8798a5ff90977d6459ce1d657cf8fe13a51e97 , < 2ef0fc3bf49db2b9df36d5f44508c9e384bfa2a1 (git)
Affected: 8a8798a5ff90977d6459ce1d657cf8fe13a51e97 , < 3e182701db612ddd794ccd5ed822e6cc1db2b972 (git)
Affected: 8a8798a5ff90977d6459ce1d657cf8fe13a51e97 , < 2f37dc436d4e61ff7ae0b0353cf91b8c10396e4d (git)
Create a notification for this product.
Linux Linux Affected: 3.3
Unaffected: 0 , < 3.3 (semver)
Unaffected: 5.10.253 , ≤ 5.10.* (semver)
Unaffected: 5.15.203 , ≤ 5.15.* (semver)
Unaffected: 6.1.167 , ≤ 6.1.* (semver)
Unaffected: 6.6.130 , ≤ 6.6.* (semver)
Unaffected: 6.12.77 , ≤ 6.12.* (semver)
Unaffected: 6.18.17 , ≤ 6.18.* (semver)
Unaffected: 6.19.7 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/connect.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e5a3b11e07b335006371915b2da47b6056c9e3bc",
              "status": "affected",
              "version": "8a8798a5ff90977d6459ce1d657cf8fe13a51e97",
              "versionType": "git"
            },
            {
              "lessThan": "54c570de9a35860dfa85fe668f23ddfda8cc7e26",
              "status": "affected",
              "version": "8a8798a5ff90977d6459ce1d657cf8fe13a51e97",
              "versionType": "git"
            },
            {
              "lessThan": "ff0ece8ed04180c52167c003362284b23cf54e8d",
              "status": "affected",
              "version": "8a8798a5ff90977d6459ce1d657cf8fe13a51e97",
              "versionType": "git"
            },
            {
              "lessThan": "3990f352bb0adc8688d0949a9c13e3110570eb61",
              "status": "affected",
              "version": "8a8798a5ff90977d6459ce1d657cf8fe13a51e97",
              "versionType": "git"
            },
            {
              "lessThan": "b746a357abfb8fdb0a171d51ec5091e786d34be1",
              "status": "affected",
              "version": "8a8798a5ff90977d6459ce1d657cf8fe13a51e97",
              "versionType": "git"
            },
            {
              "lessThan": "2ef0fc3bf49db2b9df36d5f44508c9e384bfa2a1",
              "status": "affected",
              "version": "8a8798a5ff90977d6459ce1d657cf8fe13a51e97",
              "versionType": "git"
            },
            {
              "lessThan": "3e182701db612ddd794ccd5ed822e6cc1db2b972",
              "status": "affected",
              "version": "8a8798a5ff90977d6459ce1d657cf8fe13a51e97",
              "versionType": "git"
            },
            {
              "lessThan": "2f37dc436d4e61ff7ae0b0353cf91b8c10396e4d",
              "status": "affected",
              "version": "8a8798a5ff90977d6459ce1d657cf8fe13a51e97",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/connect.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.3"
            },
            {
              "lessThan": "3.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.17",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.7",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Don\u0027t log plaintext credentials in cifs_set_cifscreds\n\nWhen debug logging is enabled, cifs_set_cifscreds() logs the key\npayload and exposes the plaintext username and password. Remove the\ndebug log to avoid exposing credentials."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:04:16.573Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e5a3b11e07b335006371915b2da47b6056c9e3bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/54c570de9a35860dfa85fe668f23ddfda8cc7e26"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff0ece8ed04180c52167c003362284b23cf54e8d"
        },
        {
          "url": "https://git.kernel.org/stable/c/3990f352bb0adc8688d0949a9c13e3110570eb61"
        },
        {
          "url": "https://git.kernel.org/stable/c/b746a357abfb8fdb0a171d51ec5091e786d34be1"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ef0fc3bf49db2b9df36d5f44508c9e384bfa2a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e182701db612ddd794ccd5ed822e6cc1db2b972"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f37dc436d4e61ff7ae0b0353cf91b8c10396e4d"
        }
      ],
      "title": "smb: client: Don\u0027t log plaintext credentials in cifs_set_cifscreds",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23303",
    "datePublished": "2026-03-25T10:26:58.166Z",
    "dateReserved": "2026-01-13T15:37:45.993Z",
    "dateUpdated": "2026-05-11T22:04:16.573Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23303",
      "date": "2026-05-27",
      "epss": "0.00035",
      "percentile": "0.10579"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23303\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-03-25T11:16:26.060\",\"lastModified\":\"2026-04-18T09:16:18.073\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: Don\u0027t log plaintext credentials in cifs_set_cifscreds\\n\\nWhen debug logging is enabled, cifs_set_cifscreds() logs the key\\npayload and exposes the plaintext username and password. Remove the\\ndebug log to avoid exposing credentials.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nsmb: cliente: No registrar credenciales en texto plano en cifs_set_cifscreds\\n\\nCuando el registro de depuraci\u00f3n est\u00e1 habilitado, cifs_set_cifscreds() registra la carga \u00fatil de la clave y expone el nombre de usuario y la contrase\u00f1a en texto plano. Eliminar el registro de depuraci\u00f3n para evitar exponer credenciales.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2ef0fc3bf49db2b9df36d5f44508c9e384bfa2a1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2f37dc436d4e61ff7ae0b0353cf91b8c10396e4d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3990f352bb0adc8688d0949a9c13e3110570eb61\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3e182701db612ddd794ccd5ed822e6cc1db2b972\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/54c570de9a35860dfa85fe668f23ddfda8cc7e26\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b746a357abfb8fdb0a171d51ec5091e786d34be1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e5a3b11e07b335006371915b2da47b6056c9e3bc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ff0ece8ed04180c52167c003362284b23cf54e8d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.