In the Linux kernel, the following vulnerability has been resolved:

smb: client: Don't log plaintext credentials in cifs_set_cifscreds

When debug logging is enabled, cifs_set_cifscreds() logs the key
payload and exposes the plaintext username and password. Remove the
debug log to avoid exposing credentials.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00024.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
8a8798a5ff90977d6459ce1d657cf8fe13a51e97 affected < ff0ece8ed04180c52167c003362284b23cf54e8d
8a8798a5ff90977d6459ce1d657cf8fe13a51e97 affected < 3990f352bb0adc8688d0949a9c13e3110570eb61
8a8798a5ff90977d6459ce1d657cf8fe13a51e97 affected < b746a357abfb8fdb0a171d51ec5091e786d34be1
8a8798a5ff90977d6459ce1d657cf8fe13a51e97 affected < 2ef0fc3bf49db2b9df36d5f44508c9e384bfa2a1
8a8798a5ff90977d6459ce1d657cf8fe13a51e97 affected < 3e182701db612ddd794ccd5ed822e6cc1db2b972
8a8798a5ff90977d6459ce1d657cf8fe13a51e97 affected < 2f37dc436d4e61ff7ae0b0353cf91b8c10396e4d
Linux Linux affected
Version Status Constraints
3.3 affected —
0 unaffected < 3.3
6.1.167 unaffected ≤ 6.1.*
6.6.130 unaffected ≤ 6.6.*
6.12.77 unaffected ≤ 6.12.*
6.18.17 unaffected ≤ 6.18.*
6.19.7 unaffected ≤ 6.19.*
7.0-rc2 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/2ef0fc3bf49db2b9df36d5f44508c9e384bfa2a1 cve-icon cve-icon
https://git.kernel.org/stable/c/2f37dc436d4e61ff7ae0b0353cf91b8c10396e4d cve-icon cve-icon
https://git.kernel.org/stable/c/3990f352bb0adc8688d0949a9c13e3110570eb61 cve-icon cve-icon
https://git.kernel.org/stable/c/3e182701db612ddd794ccd5ed822e6cc1db2b972 cve-icon cve-icon
https://git.kernel.org/stable/c/b746a357abfb8fdb0a171d51ec5091e786d34be1 cve-icon cve-icon
https://git.kernel.org/stable/c/ff0ece8ed04180c52167c003362284b23cf54e8d cve-icon cve-icon
History

Wed, 25 Mar 2026 10:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: smb: client: Don't log plaintext credentials in cifs_set_cifscreds When debug logging is enabled, cifs_set_cifscreds() logs the key payload and exposes the plaintext username and password. Remove the debug log to avoid exposing credentials.
Title smb: client: Don't log plaintext credentials in cifs_set_cifscreds
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-03-25T10:26:58.166Z

Reserved: 2026-01-13T15:37:45.993Z

Link: CVE-2026-23303

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-25T11:16:26.060

Modified: 2026-03-25T15:41:33.977

Link: CVE-2026-23303

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.