The ksmbd component in the Linux kernel calculated the maximum output buffer size using a hardcoded header length instead of the correct offset of the response structure’s Buffer field. The fix replaces this magic number with an offset calculation. If the incorrect value was used, the function could underestimate the required buffer size, potentially resulting in an out‑of‑bounds write and memory corruption. The specific weakness classification is not explicitly provided (NVD-CWE-noinfo).

Linux kernels that include ksmbd without the commit e2b76ab8b5c9 are affected. All distributions running a kernel older than this commit and exposing the ksmbd SMB service are at risk. The issue is architecture independent so any platform that builds ksmbd is impacted.

The CVSS score of 9.8 indicates a critical severity assessment. The EPSS score is below 1%, implying a very low likelihood of observed exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, a remote attacker could exploit the flaw by sending a specially crafted SMB request to a vulnerable ksmbd service, potentially leading to kernel memory corruption. The precise exploitation path is not detailed, so the likelihood of successful exploitation remains uncertain.