{"api_version":"1","generated_at":"2026-09-25T09:31:43+00:00","cve":"CVE-2026-93787","urls":{"html":"https://cve.report/CVE-2026-93787","api":"https://cve.report/api/cve/CVE-2026-93787.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-93787","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-93787"},"summary":{"title":"smb: client: bound dirent name against end of SMB response in cifs_filldir","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: bound dirent name against end of SMB response in cifs_filldir\n\ncifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST /\nFIND_NEXT response using a length (de.namelen) supplied by the server.\nThe kmalloc'd SMB response buffer is bounded, but nothing checks that\nde.name + de.namelen still lies inside that buffer before the eventual\nfilldir64() -> verify_dirent_name() -> memchr() reads namelen bytes.\n\nA hostile SMB1 server that returns an oversized FileNameLength in a\ndirectory entry therefore causes memchr() to read past the end of the\nresponse slab buffer. Reachable from any user who can list a directory\non a CIFS mount served by an attacker-controlled server (getdents64()\non the mounted directory):\n\n  BUG: KASAN: slab-out-of-bounds in memchr+0x71/0x80\n  Read of size 1 at addr ffff88800e0640cc by task poc/115\n  Call Trace:\n   dump_stack_lvl+0x64/0x80\n   print_report+0xce/0x620\n   kasan_report+0xec/0x120\n   memchr+0x71/0x80\n   filldir64+0x4c/0x6a0\n   cifs_filldir.constprop.0+0x9bb/0x1e00\n   cifs_readdir+0x2101/0x3380\n   iterate_dir+0x19c/0x520\n   __x64_sys_getdents64+0x126/0x210\n   do_syscall_64+0x107/0x5a0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nPass the end-of-response pointer down to cifs_filldir() and reject\nentries whose name would extend past that boundary.\n\nThis bug was discovered by Artiphishell's vTriage pipeline, which\ngenerated a userspace reproducer (an emulated hostile SMB1 server plus\na getdents64() client) that reliably triggers the KASAN report on an\nunpatched kernel. The fix below was drafted with the Claude coding\nassistant; a userspace reproducer is available on request.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-24 17:17:11","updated_at":"2026-09-25 05:17:02"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","data":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6","name":"https://git.kernel.org/stable/c/f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/6e3b965267b7313903baba2739992b1e2e92d540","name":"https://git.kernel.org/stable/c/6e3b965267b7313903baba2739992b1e2e92d540","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/03003506c86f90312b0966283662c42fcab66e4b","name":"https://git.kernel.org/stable/c/03003506c86f90312b0966283662c42fcab66e4b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93787","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93787","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 6e3b965267b7313903baba2739992b1e2e92d540 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 03003506c86f90312b0966283662c42fcab66e4b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.12.111 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.18.53 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.111 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.53 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/readdir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6e3b965267b7313903baba2739992b1e2e92d540","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"03003506c86f90312b0966283662c42fcab66e4b","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"6.12.111","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.18.53","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/readdir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.111","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.53","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.111","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.53","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: bound dirent name against end of SMB response in cifs_filldir\n\ncifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST /\nFIND_NEXT response using a length (de.namelen) supplied by the server.\nThe kmalloc'd SMB response buffer is bounded, but nothing checks that\nde.name + de.namelen still lies inside that buffer before the eventual\nfilldir64() -> verify_dirent_name() -> memchr() reads namelen bytes.\n\nA hostile SMB1 server that returns an oversized FileNameLength in a\ndirectory entry therefore causes memchr() to read past the end of the\nresponse slab buffer. Reachable from any user who can list a directory\non a CIFS mount served by an attacker-controlled server (getdents64()\non the mounted directory):\n\n  BUG: KASAN: slab-out-of-bounds in memchr+0x71/0x80\n  Read of size 1 at addr ffff88800e0640cc by task poc/115\n  Call Trace:\n   dump_stack_lvl+0x64/0x80\n   print_report+0xce/0x620\n   kasan_report+0xec/0x120\n   memchr+0x71/0x80\n   filldir64+0x4c/0x6a0\n   cifs_filldir.constprop.0+0x9bb/0x1e00\n   cifs_readdir+0x2101/0x3380\n   iterate_dir+0x19c/0x520\n   __x64_sys_getdents64+0x126/0x210\n   do_syscall_64+0x107/0x5a0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nPass the end-of-response pointer down to cifs_filldir() and reject\nentries whose name would extend past that boundary.\n\nThis bug was discovered by Artiphishell's vTriage pipeline, which\ngenerated a userspace reproducer (an emulated hostile SMB1 server plus\na getdents64() client) that reliably triggers the KASAN report on an\nunpatched kernel. The fix below was drafted with the Claude coding\nassistant; a userspace reproducer is available on request."}],"metrics":[{"cvssV3_1":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:N - cifs_filldir() takes FileNameLength from an SMB1 TRANS2_FIND_FIRST/FIND_NEXT directory entry received over TCP/445; CIFSFindFirst() stores that PDU in srch_inf.ntwrk_buf_start and getdents64→iterate_dir→cifs_readdir() passes each entry to cifs_filldir(), so the oversized name length is protocol data from the remote SMB peer.\nAC:L - The hostile SMB1 server sets FileNameLength (cifs_fill_dirent_dir/full/search/both) and Flags2 unicode and can place FileName near the end of the CIFSFindFirst buffer so de.name+de.namelen exceeds end_of_smb; the old namelen>max_len check only compared against the whole SMB size, so the overread is deterministic with no race.\nPR:N - The attacker is the remote SMB1 server (or a MITM on an unsigned SMB1 session) that returns the FIND_FIRST/FIND_NEXT payload; CIFSFindFirst() and cifs_filldir() use the victim's existing tcon and impose no account or capability check on that peer.\nUI:R - cifs_filldir() is reached only from cifs_dir_ops.iterate_shared (cifs_readdir) on getdents64→iterate_dir; the SMB1 server cannot inject an unsolicited FIND response into that path, so a victim process must list a directory on the CIFS mount.\nS:U - The slab-out-of-bounds read in filldir64's verify_dirent_name()/memchr() stays inside the client kernel's CIFS response buffer on the same host; this is not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - FileNameLength can be just under PATH_MAX while de.name sits at the end of the kmalloc'd FIND response, so memchr() and filldir64's unsafe_copy_dirent_name() read up to ~4095 bytes of adjacent kernel heap and copy them into the getdents64 userspace buffer.\nI:N - The defect is an over-read of the FIND entry name; cifs_filldir() does not write past the SMB buffer, and filldir64 only copies the over-read bytes to the caller's dirent buffer, giving no kernel write or control-flow primitive.\nA:H - KASAN reports a slab-out-of-bounds read in memchr() from filldir64←cifs_filldir on the hostile FileNameLength; walking those bytes off the cifs_request object into an unmapped page oopses or panics the client, and the server can retrigger it on every getdents64."}]}],"providerMetadata":{"dateUpdated":"2026-09-25T05:10:06.635Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/6e3b965267b7313903baba2739992b1e2e92d540"},{"url":"https://git.kernel.org/stable/c/03003506c86f90312b0966283662c42fcab66e4b"},{"url":"https://git.kernel.org/stable/c/f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6"}],"title":"smb: client: bound dirent name against end of SMB response in cifs_filldir","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-93787","datePublished":"2026-09-24T16:02:20.872Z","dateReserved":"2026-09-18T17:59:28.788Z","dateUpdated":"2026-09-25T05:10:06.635Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-24 17:17:11","lastModifiedDate":"2026-09-25 05:17:02","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"93787","Ordinal":"1","Title":"smb: client: bound dirent name against end of SMB response in ci","CVE":"CVE-2026-93787","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"93787","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: bound dirent name against end of SMB response in cifs_filldir\n\ncifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST /\nFIND_NEXT response using a length (de.namelen) supplied by the server.\nThe kmalloc'd SMB response buffer is bounded, but nothing checks that\nde.name + de.namelen still lies inside that buffer before the eventual\nfilldir64() -> verify_dirent_name() -> memchr() reads namelen bytes.\n\nA hostile SMB1 server that returns an oversized FileNameLength in a\ndirectory entry therefore causes memchr() to read past the end of the\nresponse slab buffer. Reachable from any user who can list a directory\non a CIFS mount served by an attacker-controlled server (getdents64()\non the mounted directory):\n\n  BUG: KASAN: slab-out-of-bounds in memchr+0x71/0x80\n  Read of size 1 at addr ffff88800e0640cc by task poc/115\n  Call Trace:\n   dump_stack_lvl+0x64/0x80\n   print_report+0xce/0x620\n   kasan_report+0xec/0x120\n   memchr+0x71/0x80\n   filldir64+0x4c/0x6a0\n   cifs_filldir.constprop.0+0x9bb/0x1e00\n   cifs_readdir+0x2101/0x3380\n   iterate_dir+0x19c/0x520\n   __x64_sys_getdents64+0x126/0x210\n   do_syscall_64+0x107/0x5a0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nPass the end-of-response pointer down to cifs_filldir() and reject\nentries whose name would extend past that boundary.\n\nThis bug was discovered by Artiphishell's vTriage pipeline, which\ngenerated a userspace reproducer (an emulated hostile SMB1 server plus\na getdents64() client) that reliably triggers the KASAN report on an\nunpatched kernel. The fix below was drafted with the Claude coding\nassistant; a userspace reproducer is available on request.","Type":"Description","Title":"smb: client: bound dirent name against end of SMB response in ci"}]}}}