CVE-2026-93787

Received Received - Intake

Buffer Overflow in Linux Kernel SMB Client

Publication date: 2026-09-24

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name against end of SMB response in cifs_filldir cifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST / FIND_NEXT response using a length (de.namelen) supplied by the server. The kmalloc'd SMB response buffer is bounded, but nothing checks that de.name + de.namelen still lies inside that buffer before the eventual filldir64() -> verify_dirent_name() -> memchr() reads namelen bytes. A hostile SMB1 server that returns an oversized FileNameLength in a directory entry therefore causes memchr() to read past the end of the response slab buffer. Reachable from any user who can list a directory on a CIFS mount served by an attacker-controlled server (getdents64() on the mounted directory): BUG: KASAN: slab-out-of-bounds in memchr+0x71/0x80 Read of size 1 at addr ffff88800e0640cc by task poc/115 Call Trace: dump_stack_lvl+0x64/0x80 print_report+0xce/0x620 kasan_report+0xec/0x120 memchr+0x71/0x80 filldir64+0x4c/0x6a0 cifs_filldir.constprop.0+0x9bb/0x1e00 cifs_readdir+0x2101/0x3380 iterate_dir+0x19c/0x520 __x64_sys_getdents64+0x126/0x210 do_syscall_64+0x107/0x5a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Pass the end-of-response pointer down to cifs_filldir() and reject entries whose name would extend past that boundary. This bug was discovered by Artiphishell's vTriage pipeline, which generated a userspace reproducer (an emulated hostile SMB1 server plus a getdents64() client) that reliably triggers the KASAN report on an unpatched kernel. The fix below was drafted with the Claude coding assistant; a userspace reproducer is available on request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-93787

EUVD

EUVD-2026-86174

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the CIFS/SMB client code. It involves a buffer overflow in the cifs_filldir function when handling directory entries from an SMB1 server. The server can provide a maliciously large filename length that causes the kernel to read past the allocated buffer during directory listing operations.

Detection Guidance

This vulnerability is triggered when a user lists a directory on a CIFS mount served by a malicious SMB1 server. Detection requires monitoring for slab-out-of-bounds errors in the kernel. Check kernel logs for KASAN reports mentioning memchr or cifs_filldir. Use dmesg | grep -i kasan or journalctl -k | grep -i kasan to search for such errors.

Impact Analysis

An attacker could exploit this by controlling an SMB1 server and tricking a user into listing a directory on a mounted CIFS share. This could cause a kernel crash (KASAN report) or potentially lead to arbitrary code execution in the kernel context.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory safety issue in the Linux CIFS client. Compliance impacts would only occur if exploitation led to unauthorized data access or system compromise, which is not described in the provided context.

Mitigation Strategies

Upgrade the Linux kernel to a patched version that includes the fix for this CVE. Avoid mounting directories from untrusted SMB1 servers. If SMB1 must be used, ensure the server is trusted and apply network-level mitigations to block malicious traffic.

Hi! I’m here to help you understand CVE-2026-93787. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70