CVE-2026-93787

A flaw was found in the Linux kernel's SMB (Server Message Block) client subsystem. When a user lists files in a directory on a mounted share, a malicious SMB server can return a crafted directory entry with an oversized filename length. Because the client fails to verify that the filename remains within the response buffer, the kernel reads beyond the allocated memory boundaries, leading to a system crash and denial of service (DoS) or potential disclosure of sensitive memory contents.

This vulnerability is rated as Important severity because an untrusted remote server can trigger an out-of-bounds kernel read, potentially causing a system crash or exposing sensitive kernel slab data to unprivileged callers. Under default Red Hat Enterprise Linux configurations, CIFS/SMB shares are not automatically mounted, restricting exposure to environments where client systems explicitly connect to external file servers. Exploitation requires a user or service to list contents on a directory mounted via the legacy SMB1 protocol, which is not used by default in modern enterprise deployments unless explicitly requested.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.