{"id":28602,"date":"2026-09-25T04:31:27","date_gmt":"2026-09-24T20:31:27","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93787"},"modified":"2026-09-25T04:31:27","modified_gmt":"2026-09-24T20:31:27","slug":"cve-2026-93787","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93787","title":{"rendered":"CVE-2026-93787 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: bound di"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>smb: client: bound dirent name against end of SMB response in cifs_filldir<\/p>\n<p>cifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST \/<br \/>\nFIND_NEXT response using a length (de.namelen) supplied by the server.<br \/>\nThe kmalloc&#8217;d SMB response buffer is bounded, but nothing checks that<br \/>\nde.name + de.namelen still lies inside that buffer before the eventual<br \/>\nfilldir64() -&gt; verify_dirent_name() -&gt; memchr() reads namelen bytes.<\/p>\n<p>A hostile SMB1 server that returns an oversized FileNameLength in a<br \/>\ndirectory entry therefore causes memchr() to read past the end of the<br \/>\nresponse slab buffer. Reachable from any user who can list a directory<br \/>\non a CIFS mount served by an attacker-controlled server (getdents64()<br \/>\non the mounted directory):<\/p>\n<p>  BUG: KASAN: slab-out-of-bounds in memchr+0x71\/0x80<br \/>\n  Read of size 1 at addr ffff88800e0640cc by task poc\/115<br \/>\n  Call Trace:<br \/>\n   dump_stack_lvl+0x64\/0x80<br \/>\n   print_report+0xce\/0x620<br \/>\n   kasan_report+0xec\/0x120<br \/>\n   memchr+0x71\/0x80<br \/>\n   filldir64+0x4c\/0x6a0<br \/>\n   cifs_filldir.constprop.0+0x9bb\/0x1e00<br \/>\n   cifs_readdir+0x2101\/0x3380<br \/>\n   iterate_dir+0x19c\/0x520<br \/>\n   __x64_sys_getdents64+0x126\/0x210<br \/>\n   do_syscall_64+0x107\/0x5a0<br \/>\n   entry_SYSCALL_64_after_hwframe+0x77\/0x7f<\/p>\n<p>Pass the end-of-response pointer down to cifs_filldir() and reject<br \/>\nentries whose name would extend past that boundary.<\/p>\n<p>This bug was discovered by Artiphishell&#8217;s vTriage pipeline, which<br \/>\ngenerated a userspace reproducer (an emulated hostile SMB1 server plus<br \/>\na getdents64() client) that reliably triggers the KASAN report on an<br \/>\nunpatched kernel. The fix below was drafted with the Claude coding<br \/>\nassistant; a userspace reproducer is available on request.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>smb: client: bound dirent name against end of SMB response in cifs_filldir<\/p>\n<p>cifs_filldir() copies the entry name out of an SMB1 TRA<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28602","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28602","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28602"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28602"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28602"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}