Linux Kernel CIFS EUVD-2026-86174

Requires the victim to mount a CIFS share from an attacker-controlled server using the legacy SMB1 dialect and then perform a directory listing (getdents64/iterate_dir), reaching the TRANS2_FIND_FIRST/FIND_NEXT dirent-parsing path in cifs_filldir(). The attacker must control the SMB server and return a directory entry with an oversized FileNameLength. Limiting factors: SMB1 is deprecated and disabled/uncommon in many modern deployments; the victim must be induced to mount and browse the hostile share (UI:R); there is no path to trigger this against a listening service without an active CIFS mount to the attacker.

This is a client-side, server-triggered out-of-bounds slab read (KASAN-confirmed CWE-125) in the Linux kernel's SMB/CIFS client. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H, base 8.1) is internally consistent with the description: the attacker is a hostile SMB1 server (PR:N - no credentials needed on the attacker side), reachability requires a victim to mount and list the attacker's share (UI:R), and impact is memory disclosure (C:H) plus kernel crash/DoS (A:H) with no integrity effect (I:N). No EPSS score, no CISA KEV listing, and no publicly posted exploit are present in the input - the Artiphishell vTriage reproducer is described as 'available on request,' so it is NOT public POC code. The real-world priority is moderate rather than urgent: it is not a default-configuration remote-unauth flaw, but rather depends on the increasingly deprecated SMB1 dialect and on a user being lured into mounting/listing an attacker-controlled server. The one signal to verify: the vector uses AV:N but the description also notes reachability by 'any user who can list a directory on a CIFS mount,' implying a local trigger path once such a mount exists - the network vector reflects the hostile-server delivery, not remote unauthenticated code execution against an exposed service.

An attacker stands up a malicious SMB1 server and induces a victim to mount it (e.g., a rogue file share, autofs, or a phishing link that triggers a CIFS mount). When the victim runs a directory listing (getdents64), the server returns a directory entry with an oversized FileNameLength; cifs_filldir() trusts that length and memchr() reads past the SMB response slab buffer, leaking adjacent kernel memory or crashing the host. A private userspace reproducer (emulated hostile SMB1 server plus a getdents64 client) reliably triggers the KASAN report, but no public exploit is available.