A vulnerability in the Linux kernel’s ksmbd SMB server allows an attacker to overflow a kernel buffer when processing a compound request that combines a directory query with a file information request. The get_file_all_info() routine fails to validate the client‑supplied OutputBufferLength before copying the filename into the FileName field, and smbConvertToUTF16() then writes up to a fixed PATH_MAX length. A crafted request with an oversized filename can therefore write beyond the allocated response buffer, corrupting kernel memory and potentially causing a system crash or, depending on an attacker’s technique, enabling execution of code with kernel privilege.

All Linux kernel implementations that include the ksmbd service before the fix are affected. This encompasses any distribution using an unpatched kernel where the committed patch for buffer size validation and safe conversion has not been applied. The vulnerability resides in the ksmbd module, which handles SMB2/SMB3 traffic, so hosts that expose SMB services to external networks are at risk.

The issue presents a classic out‑of‑bounds write that can corrupt kernel memory. No CVSS score or EPSS value is included in the CVE data, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires a remote attacker to send a specially crafted compound SMB request. While no public exploits have been documented, the theoretical impact is significant for environments that accept SMB traffic.