A vulnerability in the Linux kernel’s ksmbd SMB server allows an attacker to overflow a kernel buffer when processing a compound request that combines a directory query with a file information request. The get_file_all_info() routine fails to validate the client‑supplied OutputBufferLength before copying the filename into the FileName field, and smbConvertToUTF16() then writes up to a fixed PATH_MAX length. A crafted request with an oversized filename can therefore write beyond the allocated response buffer, corrupting kernel memory and potentially causing a system crash or, depending on an attacker’s technique, enabling execution of code with kernel privilege. This flaw corresponds to classic out‑of‑bounds writes (CWE-120) and also to off‑by‑one read/write errors (CWE-125).

All Linux kernel implementations that include the ksmbd service before the fix are affected. This encompasses any distribution using an unpatched kernel where the committed patch for buffer size validation and safe conversion has not been applied. The vulnerability resides in the ksmbd module, which handles SMB2/SMB3 traffic, so hosts that expose SMB services to external networks are at risk.

The issue presents a classic out‑of‑bounds write that can corrupt kernel memory. The CVSS score is 8.8 and the EPSS score indicates a very low exploitation probability (<1%), with no listing in CISA’s KEV catalog. Exploitation requires a remote attacker to send a specially crafted compound SMB request. While no public exploits have been documented, the theoretical impact is significant for environments that accept SMB traffic.