A compound SMB request that performs a READ followed by a QUERY_INFO(Security) operation triggers a buffer overrun in the Linux ksmbd service. During this operation the kernel incorrectly calculates the size of the security descriptor and writes beyond the allocated buffer, creating a memory corruption condition. This flaw can be leveraged by an attacker to corrupt kernel memory, potentially escalating privileges to root. The vulnerability is rooted in an inaccurate buffer size check and improper allocation logic for synthesizing POSIX ACL descriptors.

All Linux kernel releases that include the ksmbd SMB daemon and have not incorporated the patch from commit 075ea208c648cc2bcd616295b711d3637c61de45. Systems running SMB services via ksmbd with exposed interfaces to untrusted clients are affected.

The flaw can be exploited remotely over SMB traffic, allowing an attacker to overwrite kernel memory. No EPSS score or KEV listing is available, so public exploitation data is limited, but the presence of an out-of-bounds write in kernel space inherently represents a high severity risk. Attackers would need to deliver a crafted SMB compound request to a vulnerable host.