CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds
In the Linux kernel, the following vulnerability has been resolved:
smb: client: Don't log plaintext credentials in cifssetcifscreds
When debug logging is enabled, cifssetcifscreds() logs the key payload and exposes the plaintext username and password. Remove the debug log to avoid exposing credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Remove the debug log in smb client cifs_set_cifscreds() so plaintext usernames and passwords are not exposed when debug logging is enabled.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23303?
CVE-2026-23303 is considered a moderate severity vulnerability due to the risk of exposing plaintext credentials.
How do I fix CVE-2026-23303?
To fix CVE-2026-23303, update your Linux kernel to the latest version that addresses this vulnerability.
What systems are affected by CVE-2026-23303?
CVE-2026-23303 affects the Linux kernel and potentially any system using the CIFS client with debug logging enabled.
What impact does CVE-2026-23303 have on security?
CVE-2026-23303 may allow an attacker to capture sensitive credentials if debug logging is enabled.
Is there a known exploit for CVE-2026-23303?
As of now, there are no public exploits specifically targeting CVE-2026-23303, but the exposure of plaintext credentials poses a significant risk.