The vulnerability originates in the ksmbd component of the Linux kernel, where a malformed SMB2 Extended Attribute (EA) request can cause the kernel to read the EaNameLength field directly as the comparison length for a strncmp() operation without verifying that the length is valid for the received buffer. This flaw can allow uninitialized heap data to be gradually leaked to the client through the flawed comparison, potentially exposing sensitive information.

All Linux kernel variants that include ksmbd (the SMB server implementation) and have not yet incorporated the bundle of fixes that validate EaNameLength are affected. Specific version numbers are not disclosed in the CVE entry, so any kernel release prior to the patch should be considered vulnerable.

The severity score of 7.5 on the CVSS scale indicates a high impact, while the EPSS score of less than 1% suggests a low probability of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, further indicating limited known exploitation. A remote attacker who can reach the SMB service can send a crafted request to trigger the flaw, exploiting the lack of bound checking and potentially leaking confidential data. The attack vector is inferred to be network‑based, requiring only SMB protocol access from the client side.