What’s Vulnerable › Vulnerabilities

CVE-2026-31693: cifs: some missing initializations on replay

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-30 · updated 2026-10-19
• Weakness: CWE-908

Description

In the Linux kernel, the following vulnerability has been resolved: cifs: some missing initializations on replay In several places in the code, we have a label to signify the start of the code where a request can be replayed if necessary. However, some of these places were missing the necessary reinitializations of certain local variables before replay. This change makes sure that these variables get initialized after the label.

Affected products

• Linux kernel: from 6.6.32 before 6.6.128; from 6.8.1 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6; 6.8, 6.8-rc2, 6.8-rc3, 6.8-rc4, 6.8-rc5, 6.8-rc6 (+1) — fixed in 6.12.75, 6.18.16, 6.19.6, 6.6.128

How to fix

Upgrade to a fixed version: Linux kernel 6.12.75, 6.18.16, 6.19.6, 6.6.128. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/14f66f44646333d2bfd7ece36585874fd72f8286
• https://git.kernel.org/stable/c/1d731e512134495e0ef490ade0e4d91dc0d515ec
• https://git.kernel.org/stable/c/7c9ce68192eef14c777cb6ce17155d2eb2431aea
• https://git.kernel.org/stable/c/c854ab481ece4b3e5f4c2e8b22824f015ff874a5
• https://git.kernel.org/stable/c/c99e160938b627f6f28edee930e8abc157e84386

Get alerted when CVE-2026-31693 or the next vulnerability affects your stack