The Linux kernel contains a flaw in the SMB client where credentials supplied to the CIFS filesystem are inadvertently written to debug output. When debug logging is turned on, cifs_set_cifscreds() logs the key payload exposing the plaintext username and password. This results in potential information disclosure of authentication credentials to anyone who can read the kernel logs.

All Linux kernel releases that include CIFS/SMB support are potentially affected. No specific version range is provided, so any kernel version prior to the applied fix may be vulnerable until a patch is installed.

The CVSS base score of 5.5 indicates moderate severity, while the EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation likelihood. The attack vector is most likely local; an adversary with the ability to enable debug logging or read kernel logs could obtain credentials. The published fix removes the debug log entry, eliminating the disclosure path.