Read the docs
TI-2026-63141 Aliases CVE-2026-93787GHSA-59gw-x2m7-5p58

smb: client: bound dirent name against end of SMB response in cifs_filldir

Priority LOW 35Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Partial Red Hat: 16 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name against end of SMB response in cifs_filldir cifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST / FIND_NEXT response using a length (de.namelen) supplied by the server. The kmalloc'd SMB response buffer is bounded, but nothing checks that de.name + de.namelen still lies inside that buffer before the eventual filldir64() -> verify_dirent_name() -> memchr() reads namelen bytes. A hostile SMB1 server that returns an oversized FileNameLength in a directory entry therefore causes memchr() to read past the end of the response slab buffer. Reachable from any user who can list a directory on a CIFS mount served by an attacker-controlled server (getdents64() on the mounted directory): BUG: KASAN: slab-out-of-bounds in memchr+0x71/0x80 Read of size 1 at addr ffff88800e0640cc by task poc/115 Call Trace: dump_stack_lvl+0x64/0x80 print_report+0xce/0x620 kasan_report+0xec/0x120 memchr+0x71/0x80 filldir64+0x4c/0x6a0 cifs_filldir.constprop.0+0x9bb/0x1e00 cifs_readdir+0x2101/0x3380 iterate_dir+0x19c/0x520 __x64_sys_getdents64+0x126/0x210 do_syscall_64+0x107/0x5a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Pass the end-of-response pointer down to cifs_filldir() and reject entries whose name would extend past that boundary. This bug was discovered by Artiphishell's vTriage pipeline, which generated a userspace reproducer (an emulated hostile SMB1 server plus a getdents64() client) that reliably triggers the KASAN report on an unpatched kernel. The fix below was drafted with the Claude coding assistant; a userspace reproducer is available on request.

Why it matters now

EPSS 0.00344 28th percentileScored 2026-11-07
Fix Partial Linux (Linux): 6.1.189, 6.6.158, 6.12.111 +2Red Hat: 4 advisoriesRed Hat: 16 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux2.6.12 and later6.1.189, 6.6.158, 6.12.111, 6.18.53, 7.2Patch availableCNA
  • Linux VendorLinux Affected 2.6.12 and later Fixed in 6.1.189, 6.6.158, 6.12.111, 6.18.53, 7.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*——Linux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions — — ·Linux

Remediation

  • Fix · CNA Linux (Linux) Fixed in 6.1.189, 6.6.158, 6.12.111, 6.18.53, 7.2

Red Hat 4 advisories

  • RHSA-2026:93436 Released 2026-11-02 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-553.181.1.el8_10, kernel-4.18.0-553.181.1.el8_10, kernel-abi-stablelists-4.18.0-553.181.1.el8_10 +19
    • Red Hat Enterprise Linux CRB (v. 8) kernel-tools-libs-devel-4.18.0-553.181.1.el8_10
  • RHSA-2026:93437 Released 2026-11-02 · Red Hat rating Important
    kernel-rt security update
    • Red Hat Enterprise Linux NFV (v. 8) kernel-rt-4.18.0-553.181.1.rt7.522.el8_10, kernel-rt-core-4.18.0-553.181.1.rt7.522.el8_10, kernel-rt-debug-4.18.0-553.181.1.rt7.522.el8_10 +9
    • Red Hat Enterprise Linux RT (v. 8) kernel-rt-4.18.0-553.181.1.rt7.522.el8_10, kernel-rt-core-4.18.0-553.181.1.rt7.522.el8_10, kernel-rt-debug-4.18.0-553.181.1.rt7.522.el8_10 +7
  • RHSA-2026:93413 Released 2026-11-01 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • 10Base-SMTV kernel-modules-internal-6.12.0-211.72.1.el10_2
    • Red Hat Enterprise Linux AppStream (v. 10) kernel-64k-debug-devel-6.12.0-211.72.1.el10_2, kernel-64k-debug-devel-matched-6.12.0-211.72.1.el10_2, kernel-64k-devel-6.12.0-211.72.1.el10_2 +12
    • Red Hat Enterprise Linux BaseOS (v. 10) kernel-6.12.0-211.72.1.el10_2, kernel-64k-6.12.0-211.72.1.el10_2, kernel-64k-core-6.12.0-211.72.1.el10_2 +29
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) kernel-tools-libs-devel-6.12.0-211.72.1.el10_2, libperf-6.12.0-211.72.1.el10_2
    • Red Hat Enterprise Linux Hidden (v. 10) kernel-modules-internal-6.12.0-211.72.1.el10_2
    • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt-6.12.0-211.72.1.el10_2, kernel-rt-64k-6.12.0-211.72.1.el10_2, kernel-rt-64k-core-6.12.0-211.72.1.el10_2 +21
    • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt-6.12.0-211.72.1.el10_2, kernel-rt-core-6.12.0-211.72.1.el10_2, kernel-rt-debug-6.12.0-211.72.1.el10_2 +9
Show 1 more Red Hat advisories
  • RHSA-2026:93412 Released 2026-11-01 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-687.64.1.el9_8, kernel-64k-debug-devel-matched-5.14.0-687.64.1.el9_8, kernel-64k-devel-5.14.0-687.64.1.el9_8 +12
    • Red Hat Enterprise Linux BaseOS (v. 9) kernel-5.14.0-687.64.1.el9_8, kernel-64k-5.14.0-687.64.1.el9_8, kernel-64k-core-5.14.0-687.64.1.el9_8 +28
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) kernel-tools-libs-devel-5.14.0-687.64.1.el9_8, libperf-5.14.0-687.64.1.el9_8
    • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-687.64.1.el9_8, kernel-rt-64k-5.14.0-687.64.1.el9_8, kernel-rt-64k-core-5.14.0-687.64.1.el9_8 +21
    • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-687.64.1.el9_8, kernel-rt-core-5.14.0-687.64.1.el9_8, kernel-rt-debug-5.14.0-687.64.1.el9_8 +9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 9AffectedNo fix yet
10Base-SMTVFixed RHSA-2026:93413
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:93413
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:93412
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:93413
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:93436
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:93412
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:93436
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:93413
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:93412
Red Hat Enterprise Linux Hidden (v. 10)Fixed RHSA-2026:93413
Red Hat Enterprise Linux NFV (v. 8)Fixed RHSA-2026:93437
Red Hat Enterprise Linux RT (v. 8)Fixed RHSA-2026:93437
Red Hat Enterprise Linux Real Time (v. 10)Fixed RHSA-2026:93413
Red Hat Enterprise Linux Real Time (v. 9)Fixed RHSA-2026:93412
Red Hat Enterprise Linux Real Time for NFV (v. 10)Fixed RHSA-2026:93413
Red Hat Enterprise Linux Real Time for NFV (v. 9)Fixed RHSA-2026:93412
Not affected: 2 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-93787
  2. 2026-10-03 Alias added: GHSA-59gw-x2m7-5p58
  3. 2026-10-03 Fix available: Linux/Linux@4cb3d79beee0fecc739ce07af915d503f29ae557, Linux/[email protected], Linux/[email protected] +1 · CNA
  4. 2026-10-03 2 new references · CNA
  5. 2026-10-09 Affected versions changed · Red Hat
  6. 2026-10-09 CVSS score changed · Red Hat
  7. 2026-11-02 Fix available: RHSA-2026:93413 · Red Hat
  8. 2026-11-02 Fix available: RHSA-2026:93412 · Red Hat
  9. 2026-11-02 Fix available: 10Base-SMTV, Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 9) +9 · Red Hat
  10. 2026-11-02 Fix available: RHSA-2026:93436 · Red Hat
  11. 2026-11-02 Fix available: RHSA-2026:93437 · Red Hat
  12. 2026-11-02 Fix available: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8), Red Hat Enterprise Linux NFV (v. 8) +1 · Red Hat

References

Other 5

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
See all 21741 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences