---
id: CVE-2026-31693
title: 'cifs: some missing initializations on replay'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  cifs: some missing initializations on replay

  In several places in the code, we have a label to signify
  the start of the code where a request can be replayed if
  necessa…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 433042a91f9373241307725b52de573933ffedbf <
    c854ab481ece4b3e5f4c2e8b22824f015ff874a5
  - >-
    Linux >= 4f1fffa2376922f3d1d506e49c0fd445b023a28e <
    1d731e512134495e0ef490ade0e4d91dc0d515ec
  - >-
    Linux >= 4f1fffa2376922f3d1d506e49c0fd445b023a28e <
    7c9ce68192eef14c777cb6ce17155d2eb2431aea
  - >-
    Linux >= 4f1fffa2376922f3d1d506e49c0fd445b023a28e <
    c99e160938b627f6f28edee930e8abc157e84386
  - >-
    Linux >= 4f1fffa2376922f3d1d506e49c0fd445b023a28e <
    14f66f44646333d2bfd7ece36585874fd72f8286
  - Linux >= 6.6.32 < 6.6.128
  - Linux 6.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:12:31.622754Z'
published: '2026-04-30'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:24.344Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31693'
references:
  - url: 'https://git.kernel.org/stable/c/c854ab481ece4b3e5f4c2e8b22824f015ff874a5'
  - url: 'https://git.kernel.org/stable/c/1d731e512134495e0ef490ade0e4d91dc0d515ec'
  - url: 'https://git.kernel.org/stable/c/7c9ce68192eef14c777cb6ce17155d2eb2431aea'
  - url: 'https://git.kernel.org/stable/c/c99e160938b627f6f28edee930e8abc157e84386'
  - url: 'https://git.kernel.org/stable/c/14f66f44646333d2bfd7ece36585874fd72f8286'
tags:
  - cve.org
epss: 0.00175
epssPercentile: 0.06546
ingestedAt: '2026-10-16T17:24:46.671Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

cifs: some missing initializations on replay

In several places in the code, we have a label to signify
the start of the code where a request can be replayed if
necessary. However, some of these places were missing the
necessary reinitializations of certain local variables
before replay.

This change makes sure that these variables get initialized
after the label.

## Affected

- `Linux >= 433042a91f9373241307725b52de573933ffedbf < c854ab481ece4b3e5f4c2e8b22824f015ff874a5`
- `Linux >= 4f1fffa2376922f3d1d506e49c0fd445b023a28e < 1d731e512134495e0ef490ade0e4d91dc0d515ec`
- `Linux >= 4f1fffa2376922f3d1d506e49c0fd445b023a28e < 7c9ce68192eef14c777cb6ce17155d2eb2431aea`
- `Linux >= 4f1fffa2376922f3d1d506e49c0fd445b023a28e < c99e160938b627f6f28edee930e8abc157e84386`
- `Linux >= 4f1fffa2376922f3d1d506e49c0fd445b023a28e < 14f66f44646333d2bfd7ece36585874fd72f8286`
- `Linux >= 6.6.32 < 6.6.128`
- `Linux 6.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.