A compound SMB request that performs a READ followed by a QUERY_INFO(Security) operation triggers a buffer overrun in the Linux ksmbd service. During this operation the kernel incorrectly calculates the size of the security descriptor and writes beyond the allocated buffer, creating a memory corruption condition. This flaw can be leveraged by an attacker to corrupt kernel memory, potentially escalating privileges to root. The vulnerability is rooted in an inaccurate buffer size check and improper allocation logic for synthesizing POSIX ACL descriptors.

All Linux kernel releases that include the ksmbd SMB daemon and have not incorporated the patch from commit 075ea208c648cc2bcd616295b711d3637c61de45. Systems running SMB services via ksmbd with exposed interfaces to untrusted clients are affected.

The flaw can be exploited over SMB traffic, as a crafted SMB compound request could trigger the buffer overrun. This inference is based on the description of the vulnerability in the ksmbd service. The CVSS score is 8.8, classifying this vulnerability as High severity. The EPSS score is < 1% and the vulnerability is not listed in KEV, indicating a low probability of exploitation and no current known exploitation in the wild, but the presence of an out-of-bounds write in kernel space still represents a high severity risk.