CVE-2026-93787: smb: client: bound dirent name against end of SMB response in cifs_filldir
In the Linux kernel, the following vulnerability has been resolved:
smb: client: bound dirent name against end of SMB response in cifsfilldir
cifsfilldir() copies the entry name out of an SMB1 TRANS2FINDFIRST / FINDNEXT response using a length (de.namelen) supplied by the server. The kmalloc'd SMB response buffer is bounded, but nothing checks that de.name + de.namelen still lies inside that buffer before the eventual filldir64() -> verifydirentname() -> memchr() reads namelen bytes.
A hostile SMB1 server that returns an oversized FileNameLength in a directory entry therefore causes memchr() to read past the end of the response slab buffer. Reachable from any user who can list a directory on a CIFS mount served by an attacker-controlled server (getdents64() on the mounted directory):
BUG: KASAN: slab-out-of-bounds in memchr+0x71/0x80 Read of size 1 at addr ffff88800e0640cc by task poc/115 Call Trace: dumpstacklvl+0x64/0x80 printreport+0xce/0x620 kasanreport+0xec/0x120 memchr+0x71/0x80 filldir64+0x4c/0x6a0 cifsfilldir.constprop.0+0x9bb/0x1e00 cifsreaddir+0x2101/0x3380 iteratedir+0x19c/0x520 x64sysgetdents64+0x126/0x210 dosyscall64+0x107/0x5a0 entrySYSCALL64afterhwframe+0x77/0x7f
Pass the end-of-response pointer down to cifsfilldir() and reject entries whose name would extend past that boundary.
This bug was discovered by Artiphishell's vTriage pipeline, which generated a userspace reproducer (an emulated hostile SMB1 server plus a getdents64() client) that reliably triggers the KASAN report on an unpatched kernel. The fix below was drafted with the Claude coding assistant; a userspace reproducer is available on request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In cifs_filldir(), pass the end-of-response pointer and reject directory entries whose name (de.name + de.namelen) extends past the SMB response buffer before calling filldir64()/memchr().
Event History
Frequently Asked Questions
Who can trigger the out-of-bounds read?
Any user able to list a directory on a CIFS mount can reach the vulnerable path, provided that mount is served by an attacker-controlled SMB1 server. The triggering operation is a directory listing such as getdents64().
What does an attacker need to provide?
The attacker needs to control the SMB1 server serving the CIFS mount and return a malformed TRANS2_FIND_FIRST or TRANS2_FIND_NEXT directory-entry response with an oversized FileNameLength. That length causes the client to read beyond the allocated SMB response buffer.
How can this be detected during testing or investigation?
The reported failure manifests as a KASAN slab-out-of-bounds read in memchr, reached through filldir64, cifs_filldir, cifs_readdir, and getdents64 while listing a directory on the affected mount.