CVE-2026-93787

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the SMB client where the cifs filldir() function copies entry names from SMB1 TRANS2 FIND FIRST or FIND NEXT responses using a length de.namelen provided by the server. Because the system fails to verify if the sum of de.name and de.namelen remains within the bounds of the allocated SMB response buffer, a hostile server can provide an oversized FileNameLength. This leads to a slab-out-of-bounds read when the memchr() function is called via filldir64() and verify dirent name(). The issue is reachable by any user attempting to list a directory on a CIFS mount served by an attacker-controlled server using getdents64().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.