CVE-2026-93787 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel-based systems, particularly those with CIFS mounts exposed to untrusted servers, should assess their exposure and prioritize patching and monitoring.

Why it matters

This vulnerability in the Linux kernel's SMB client implementation can lead to a slab-out-of-bounds read, potentially causing denial-of-service attacks, data corruption, or unauthorized access. Defenders should prioritize patching and monitoring, particularly for systems with CIFS mounts exposed to untrusted servers.

• Potential for denial-of-service (DoS) attacks through exploitation of this vulnerability
• Possible data corruption or unauthorized access to sensitive information
• Need for verification of Linux kernel versions and CIFS mount configurations
• Potential for attackers to gain elevated privileges on affected systems

Technical summary

The cifs_filldir() function in the Linux kernel's SMB client implementation does not properly bound the directory entry name against the end of the SMB response, allowing a hostile SMB1 server to cause a slab-out-of-bounds read when listing directories on a CIFS mount. This vulnerability can lead to denial-of-service attacks, data corruption, or unauthorized access. Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly for systems with CIFS mounts that may be exposed to untrusted servers. The fix involves passing the end-of-response pointer down to cifs_filldir() and rejecting entries whose name would extend past that boundary.

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly for systems with CIFS mounts that may be exposed to untrusted servers.

Recommended defensive actions

• Verify and apply patches for Linux kernel versions affected by this vulnerability
• Review CIFS mount configurations to ensure they are not exposed to untrusted servers
• Monitor for suspicious activity on CIFS mounts
• Perform vulnerability scanning to identify potentially affected systems
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Close the item only after evidence is documented

Evidence notes

The vulnerability was discovered by Artiphishell's vTriage pipeline, which generated a userspace reproducer that reliably triggers the KASAN report on an unpatched kernel. The reproducer emulates a hostile SMB1 server and a getdents64() client. The fix was drafted with the Claude coding assistant. The vulnerability affects Linux kernel versions and can be mitigated by verifying and applying patches. The CIFS mount configurations should be reviewed to ensure they are not exposed to untrusted servers.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.