CVE-2026-93787

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93787", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-18T17:59:28.788Z", "datePublished": "2026-09-24T16:02:20.872Z", "dateUpdated": "2026-10-03T10:57:22.488Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-03T10:57:22.488Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: bound dirent name against end of SMB response in cifs_filldir\n\ncifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST /\nFIND_NEXT response using a length (de.namelen) supplied by the server.\nThe kmalloc'd SMB response buffer is bounded, but nothing checks that\nde.name + de.namelen still lies inside that buffer before the eventual\nfilldir64() -> verify_dirent_name() -> memchr() reads namelen bytes.\n\nA hostile SMB1 server that returns an oversized FileNameLength in a\ndirectory entry therefore causes memchr() to read past the end of the\nresponse slab buffer. Reachable from any user who can list a directory\non a CIFS mount served by an attacker-controlled server (getdents64()\non the mounted directory):\n\n BUG: KASAN: slab-out-of-bounds in memchr+0x71/0x80\n Read of size 1 at addr ffff88800e0640cc by task poc/115\n Call Trace:\n dump_stack_lvl+0x64/0x80\n print_report+0xce/0x620\n kasan_report+0xec/0x120\n memchr+0x71/0x80\n filldir64+0x4c/0x6a0\n cifs_filldir.constprop.0+0x9bb/0x1e00\n cifs_readdir+0x2101/0x3380\n iterate_dir+0x19c/0x520\n __x64_sys_getdents64+0x126/0x210\n do_syscall_64+0x107/0x5a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nPass the end-of-response pointer down to cifs_filldir() and reject\nentries whose name would extend past that boundary.\n\nThis bug was discovered by Artiphishell's vTriage pipeline, which\ngenerated a userspace reproducer (an emulated hostile SMB1 server plus\na getdents64() client) that reliably triggers the KASAN report on an\nunpatched kernel. The fix below was drafted with the Claude coding\nassistant; a userspace reproducer is available on request."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - cifs_filldir() takes FileNameLength from an SMB1 TRANS2_FIND_FIRST/FIND_NEXT directory entry received over TCP/445; CIFSFindFirst() stores that PDU in srch_inf.ntwrk_buf_start and getdents64\u2192iterate_dir\u2192cifs_readdir() passes each entry to cifs_filldir(), so the oversized name length is protocol data from the remote SMB peer.\nAC:L - The hostile SMB1 server sets FileNameLength (cifs_fill_dirent_dir/full/search/both) and Flags2 unicode and can place FileName near the end of the CIFSFindFirst buffer so de.name+de.namelen exceeds end_of_smb; the old namelen>max_len check only compared against the whole SMB size, so the overread is deterministic with no race.\nPR:N - The attacker is the remote SMB1 server (or a MITM on an unsigned SMB1 session) that returns the FIND_FIRST/FIND_NEXT payload; CIFSFindFirst() and cifs_filldir() use the victim's existing tcon and impose no account or capability check on that peer.\nUI:R - cifs_filldir() is reached only from cifs_dir_ops.iterate_shared (cifs_readdir) on getdents64\u2192iterate_dir; the SMB1 server cannot inject an unsolicited FIND response into that path, so a victim process must list a directory on the CIFS mount.\nS:U - The slab-out-of-bounds read in filldir64's verify_dirent_name()/memchr() stays inside the client kernel's CIFS response buffer on the same host; this is not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - FileNameLength can be just under PATH_MAX while de.name sits at the end of the kmalloc'd FIND response, so memchr() and filldir64's unsafe_copy_dirent_name() read up to ~4095 bytes of adjacent kernel heap and copy them into the getdents64 userspace buffer.\nI:N - The defect is an over-read of the FIND entry name; cifs_filldir() does not write past the SMB buffer, and filldir64 only copies the over-read bytes to the caller's dirent buffer, giving no kernel write or control-flow primitive.\nA:H - KASAN reports a slab-out-of-bounds read in memchr() from filldir64\u2190cifs_filldir on the hostile FileNameLength; walking those bytes off the cifs_request object into an unmapped page oopses or panics the client, and the server can retrigger it on every getdents64."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/readdir.c"], "versions": [{"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "4cb3d79beee0fecc739ce07af915d503f29ae557", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "cf87ef1e62ed31a439064cef69d6eec38c68bd92", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "6e3b965267b7313903baba2739992b1e2e92d540", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "03003506c86f90312b0966283662c42fcab66e4b", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/readdir.c"], "versions": [{"version": "2.6.12", "status": "affected"}, {"version": "0", "lessThan": "2.6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4cb3d79beee0fecc739ce07af915d503f29ae557"}, {"url": "https://git.kernel.org/stable/c/cf87ef1e62ed31a439064cef69d6eec38c68bd92"}, {"url": "https://git.kernel.org/stable/c/6e3b965267b7313903baba2739992b1e2e92d540"}, {"url": "https://git.kernel.org/stable/c/03003506c86f90312b0966283662c42fcab66e4b"}, {"url": "https://git.kernel.org/stable/c/f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6"}], "title": "smb: client: bound dirent name against end of SMB response in cifs_filldir", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/readdir.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4cb3d79beee0fecc739ce07af915d503f29ae557", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "cf87ef1e62ed31a439064cef69d6eec38c68bd92", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "6e3b965267b7313903baba2739992b1e2e92d540", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "03003506c86f90312b0966283662c42fcab66e4b", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/readdir.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.12"}, {"lessThan": "2.6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: bound dirent name against end of SMB response in cifs_filldir\n\ncifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST /\nFIND_NEXT response using a length (de.namelen) supplied by the server.\nThe kmalloc'd SMB response buffer is bounded, but nothing checks that\nde.name + de.namelen still lies inside that buffer before the eventual\nfilldir64() -> verify_dirent_name() -> memchr() reads namelen bytes.\n\nA hostile SMB1 server that returns an oversized FileNameLength in a\ndirectory entry therefore causes memchr() to read past the end of the\nresponse slab buffer. Reachable from any user who can list a directory\non a CIFS mount served by an attacker-controlled server (getdents64()\non the mounted directory):\n\n BUG: KASAN: slab-out-of-bounds in memchr+0x71/0x80\n Read of size 1 at addr ffff88800e0640cc by task poc/115\n Call Trace:\n dump_stack_lvl+0x64/0x80\n print_report+0xce/0x620\n kasan_report+0xec/0x120\n memchr+0x71/0x80\n filldir64+0x4c/0x6a0\n cifs_filldir.constprop.0+0x9bb/0x1e00\n cifs_readdir+0x2101/0x3380\n iterate_dir+0x19c/0x520\n __x64_sys_getdents64+0x126/0x210\n do_syscall_64+0x107/0x5a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nPass the end-of-response pointer down to cifs_filldir() and reject\nentries whose name would extend past that boundary.\n\nThis bug was discovered by Artiphishell's vTriage pipeline, which\ngenerated a userspace reproducer (an emulated hostile SMB1 server plus\na getdents64() client) that reliably triggers the KASAN report on an\nunpatched kernel. The fix below was drafted with the Claude coding\nassistant; a userspace reproducer is available on request."}], "id": "CVE-2026-93787", "lastModified": "2026-10-03T11:17:48.293", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-24T17:17:11.363", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/03003506c86f90312b0966283662c42fcab66e4b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4cb3d79beee0fecc739ce07af915d503f29ae557"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6e3b965267b7313903baba2739992b1e2e92d540"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cf87ef1e62ed31a439064cef69d6eec38c68bd92"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir", "id": "2540555", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540555"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the Linux kernel's SMB (Server Message Block) client subsystem. When a user lists files in a directory on a mounted share, a malicious SMB server can return a crafted directory entry with an oversized filename length. Because the client fails to verify that the filename remains within the response buffer, the kernel reads beyond the allocated memory boundaries, leading to a system crash and denial of service (DoS) or potential disclosure of sensitive memory contents."], "name": "CVE-2026-93787", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93787\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93787\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93787.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6e3b965267b7313903baba2739992b1e2e92d540]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,03003506c86f90312b0966283662c42fcab66e4b]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.111)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-24T21:00:17.282925+00:00", "updated": "2026-09-25T08:00:13.900462+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-125"]}