Submit finding

All findings

bynario-linux-smb1-september-2026-fixes high

Linux credits Bynario AI on two SMB1 parser fixes

Two merged Linux commits carry Assisted-by: Bynario AI on SMB1 response-validation flaws that could cause out-of-bounds reads and kernel information exposure.

Bug class
Out-of-bounds read, kernel heap disclosure, and denial of service
Affected codebase
Linux kernel CIFS/SMB1 client
Credited system
BynarIO AI
Disclosed
September 2, 2026
Attribution
Direct source attribution
Severity
high
Source status: Both accepted upstream commits include an Assisted-by: Bynario AI trailer and describe malicious-server security impact. No CVE mapping was public at the cutoff.

Summary

One fix rejects undersized SMB1 READ responses before parsing data. The other validates a server-controlled DataOffset. A malicious or compromised SMB1 server could otherwise trigger an out-of-bounds kernel read, expose heap data, or crash the client.

The upstream record says Assisted-by: Bynario AI. That directly establishes AI assistance in accepted security fixes while leaving any separate human reporting credit intact.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.