Out-of-bounds read in Linux kernel - CVE-2026-93787

Vulnerability details

The vulnerability allows a remote attacker to cause an out-of-bounds read.

The vulnerability exists due to improper bounds checking in cifs_filldir() when processing SMB1 TRANS2 directory enumeration responses. A remote attacker can return a directory entry with an oversized FileNameLength to cause an out-of-bounds read.

User interaction is required to list a directory on a CIFS mount served by an attacker-controlled SMB1 server.

Affected software

How to mitigate CVE-2026-93787

External References

• https://git.kernel.org/stable/c/03003506c86f90312b0966283662c42fcab66e4b
• https://git.kernel.org/stable/c/6e3b965267b7313903baba2739992b1e2e92d540
• https://git.kernel.org/stable/c/f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6

Related Security Bulletins

• Out-of-bounds read in Linux kernel smb client