CVE-2026-93787

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: bound dirent name against end of SMB response in cifs_filldir

cifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST /

FIND_NEXT response using a length (de.namelen) supplied by the server.

The kmalloc'd SMB response buffer is bounded, but nothing checks that

de.name + de.namelen still lies inside that buffer before the eventual

filldir64() -> verify_dirent_name() -> memchr() reads namelen bytes.

A hostile SMB1 server that returns an oversized FileNameLength in a

directory entry therefore causes memchr() to read past the end of the

response slab buffer. Reachable from any user who can list a directory

on a CIFS mount served by an attacker-controlled server (getdents64()

on the mounted directory):

BUG: KASAN: slab-out-of-bounds in memchr+0x71/0x80

Read of size 1 at addr ffff88800e0640cc by task poc/115

Call Trace:

dump_stack_lvl+0x64/0x80

print_report+0xce/0x620

kasan_repor

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References