Look up another CVE · open CVE-2026-93787 in the interactive tracker
CVE-2026-93787
smb: client: bound dirent name against end of SMB response in cifs_filldir
Published 2026-09-24 (24 days ago) by the Linux kernel CNA. Subsystem fs/smb. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-93787 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
cifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST / FIND_NEXT response using a length (de.namelen) supplied by the server. The kmalloc'd SMB response buffer is bounded, but nothing checks that de.name + de.namelen still lies inside that buffer before the eventual filldir64() -> verify_dirent_name() -> memchr() reads namelen bytes. A hostile SMB1 server that returns an oversized FileNameLength in a directory entry therefore causes memchr() to read past the end of the response slab buffer. Reachable from any user who can list a directory on a CIFS mount served by an attacker-controlled server (getdents64() on the mounted directory): BUG: KASAN: slab-out-of-bounds in memchr+0x71/0x80 Read of size 1 at addr ffff88800e0640cc by task poc/115 Call Trace: dump_stack_lvl+0x64/0x80 print_report+0xce/0x620 kasan_report+0xec/0x120 memchr+0x71/0x80 filldir64+0x4c/0x6a0 cifs_filldir.constprop.0+0x9bb/0x1e00 cifs_readdir+0x2101/0x3380 iterate_dir+0x19c/0x520 __x64_sys_getdents64+0x126/0x210 do_syscall_64+0x107/0x5a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Pass the end-of-response pointer down to cifs_filldir() and reject entries whose name would extend past that boundary. This bug was discovered by Artiphishell's vTriage pipeline, which generated a userspace reproducer (an emulated hostile SMB1 server plus a getdents64() client) that reliably triggers the KASAN report on an unpatched kernel. The fix below was drafted with the Claude coding assistant; a userspace reproducer is available on request.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/smb/client/readdir.c
- What this is
- COMMON INTERNET FILE SYSTEM CLIENT (CIFS and SMB3)MAINTAINERS section matched on fs/smb/client/ · linux-cifs@vger.kernel.org · Supported
- Kernel module
- cifs
Check it on the machine
grep -wE 'CONFIG_CIFS|CONFIG_SMBFS' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w cifsPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sid, bookworm · linux-6.12m
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_CIFS, CONFIG_SMBFS
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-24 (24 days ago)source
- CVSS
- 8.1 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.34%, higher than 26.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/smb
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 2.6.12 | 6.1.189 | 4cb3d79beee0 |
| 2.6.12 | 6.6.158 | cf87ef1e62ed |
| 2.6.12 | 6.12.111 | 6e3b965267b7 |
| 2.6.12 | 6.18.53 | 03003506c86f |
| 2.6.12 | 7.2 | f8cf09a53a0d |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- cifs_filldir() takes FileNameLength from an SMB1 TRANS2_FIND_FIRST/FIND_NEXT directory entry received over TCP/445; CIFSFindFirst() stores that PDU in srch_inf.ntwrk_buf_start and getdents64→iterate_dir→cifs_readdir() passes each entry to cifs_filldir(), so the oversized name length is protocol data from the remote SMB peer.
- AC:LAttack complexity, low
- The hostile SMB1 server sets FileNameLength (cifs_fill_dirent_dir/full/search/both) and Flags2 unicode and can place FileName near the end of the CIFSFindFirst buffer so de.name+de.namelen exceeds end_of_smb; the old namelen>max_len check only compared against the whole SMB size, so the overread is deterministic with no race.
- PR:NPrivileges required, none
- The attacker is the remote SMB1 server (or a MITM on an unsigned SMB1 session) that returns the FIND_FIRST/FIND_NEXT payload; CIFSFindFirst() and cifs_filldir() use the victim's existing tcon and impose no account or capability check on that peer.
- UI:RUser interaction, required
- cifs_filldir() is reached only from cifs_dir_ops.iterate_shared (cifs_readdir) on getdents64→iterate_dir; the SMB1 server cannot inject an unsolicited FIND response into that path, so a victim process must list a directory on the CIFS mount.
- S:UScope, unchanged
- The slab-out-of-bounds read in filldir64's verify_dirent_name()/memchr() stays inside the client kernel's CIFS response buffer on the same host; this is not a VM escape, IOMMU bypass, or sandbox boundary crossing.
- C:HConfidentiality impact, high
- FileNameLength can be just under PATH_MAX while de.name sits at the end of the kmalloc'd FIND response, so memchr() and filldir64's unsafe_copy_dirent_name() read up to ~4095 bytes of adjacent kernel heap and copy them into the getdents64 userspace buffer.
- I:NIntegrity impact, none
- The defect is an over-read of the FIND entry name; cifs_filldir() does not write past the SMB buffer, and filldir64 only copies the over-read bytes to the caller's dirent buffer, giving no kernel write or control-flow primitive.
- A:HAvailability impact, high
- KASAN reports a slab-out-of-bounds read in memchr() from filldir64←cifs_filldir on the hostile FileNameLength; walking those bytes off the cifs_request object into an unmapped page oopses or panics the client, and the server can retrigger it on every getdents64.