In the Linux kernel, a missing bounds-check in the cifs_filldir routine allows a CIFS client to read past the end of an SMB1 TRANS2_FIND_FIRST/FIND_NEXT response buffer. When an attacker-controlled SMB1 server supplies an overly large FileNameLength value, the kernel’s memchr reads beyond the allocated slab, generating a KASAN error that can crash the kernel or expose kernel memory contents. The flaw is triggered by any user capable of listing a directory on a CIFS mount served by the malicious server, such as via getdents64 on the mounted share.

This vulnerability affects all versions of the Linux kernel that implement the cifs_filldir path prior to the upstream fix. No specific version list is provided, so all unpatched kernel releases deploying CIFS are potentially impacted.

The CVSS score is 8.1, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to run a rogue SMB1 server that a victim can reach from a machine with a CIFS mount. Because SMB1 is widely considered insecure and is often disabled in modern deployments, the practical attack surface is limited, yet the impact of a kernel crash or data leak warrants urgent attention. A knowledgeable adversary could mount the CIFS share from a local or network source and trigger the out-of-bounds read by simply performing a directory listing on the affected share.