Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name against end of SMB response in cifs_filldir cifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST / FIND_NEXT response using a length (de.namelen) supplied by the server. The kmalloc'd SMB response buffer is bounded, but nothing checks that de.name + de.namelen still lies inside that buffer before the eventual filldir64() -> verify_dirent_name() -> memchr() reads namelen bytes. A hostile SMB1 server that returns an oversized FileNameLength in a directory entry therefore causes memchr() to read past the end of the response slab buffer. Reachable from any user who can list a directory on a CIFS mount served by an attacker-controlled server (getdents64() on the mounted directory): BUG: KASAN: slab-out-of-bounds in memchr+0x71/0x80 Read of size 1 at addr ffff88800e0640cc by task poc/115 Call Trace: dump_stack_lvl+0x64/0x80 print_report+0xce/0x620 kasan_report+0xec/0x120 memchr+0x71/0x80 filldir64+0x4c/0x6a0 cifs_filldir.constprop.0+0x9bb/0x1e00 cifs_readdir+0x2101/0x3380 iterate_dir+0x19c/0x520 __x64_sys_getdents64+0x126/0x210 do_syscall_64+0x107/0x5a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Pass the end-of-response pointer down to cifs_filldir() and reject entries whose name would extend past that boundary. This bug was discovered by Artiphishell's vTriage pipeline, which generated a userspace reproducer (an emulated hostile SMB1 server plus a getdents64() client) that reliably triggers the KASAN report on an unpatched kernel. The fix below was drafted with the Claude coding assistant; a userspace reproducer is available on request.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-24T17:17:11.363Z",
  "pubdate": "2026-09-24T17:17:11.363Z",
  "executiveSummary": "This vulnerability is an out-of-bounds read flaw within the Linux kernel's CIFS (Common Internet File System) client implementation.\nThe issue resides in the cifs_filldir function, which fails to properly validate the length of filenames provided by a remote SMB1 server during directory listing operations (getdents64).\nA malicious or compromised SMB1 server can craft a response with an oversized FileNameLength value, forcing the kernel to read memory beyond the allocated slab buffer.\nSuccessful exploitation results in a KASAN slab-out-of-bounds read, which leads to a kernel crash (denial of service) or potential information disclosure, depending on the memory layout and the sensitive data present adjacent to the buffer.\nThe vulnerability is reachable by any user capable of listing a directory on a CIFS mount, making the attack vector local to the client system but dependent on an attacker-controlled remote server.\nThis represents a significant risk for systems mounting untrusted or hostile SMB1 shares, as the attacker effectively controls the input causing the memory safety violation.",
  "technicalDetails": "The root cause of this vulnerability is a failure in the cifs_filldir() function to sanitize the length parameters of directory entries provided in an SMB1 TRANS2_FIND_FIRST or FIND_NEXT response. Specifically, the client kernel component consumes a length value (de.namelen) provided by the server without verifying whether the name data associated with that length fits within the remaining bounds of the kmalloc'd SMB response buffer.\nDuring the processing of directory listings, the kernel invokes cifs_filldir(), which eventually triggers verify_dirent_name() and memchr(). These functions attempt to operate on the filename provided by the server. Because there is no check to ensure that de.name + de.namelen does not exceed the end of the response buffer, the execution context performs a read operation at an address outside the legitimate buffer boundaries.\nThe exploitation flow begins when an attacker sets up a malicious SMB1 server. A target user on the client system mounts this share and performs a getdents64() system call on a directory within the mount. The malicious server responds to the client's request with a crafted directory entry containing an arbitrarily large FileNameLength. Upon receiving this response, cifs_filldir() processes the entry, and the downstream memchr() function performs a slab-out-of-bounds read at the invalid address.\nThe vulnerability specifically affects the SMB1 protocol implementation within the Linux kernel's CIFS client. Because the kernel memory allocator (SLAB/SLUB) is involved, KASAN (Kernel Address Sanitizer) instrumentation reliably flags this as a slab-out-of-bounds read. The impact is primarily a kernel panic resulting in a denial of service. However, because this involves an out-of-bounds read, there is a theoretical risk that sensitive memory contents could be leaked if the kernel subsequently processes or exposes the data read from the invalid location.\nThe vulnerability requires the client to successfully mount a share provided by a hostile server. Since the check for the end-of-response pointer is absent, the kernel cannot discern between valid directory metadata and malformed payloads intended to trigger the out-of-bounds access. The fix involves explicitly passing the end-of-response boundary to cifs_filldir() and enforcing a validation check that rejects any directory entry where the name length exceeds the available buffer space."
}