The Linux kernel SMB client contained an out‑of‑bounds read that occurs when parsing a symlink error response containing a STATUS_STOPPED_ON_SYMLINK code. The vulnerability arises because the parser advances the pointer without verifying that the entire context header and substitute name fit within the supplied buffer, allowing memory beyond the end of the input buffer to be read and returned to the caller via readlink(2). This allows an attacker to read arbitrary kernel heap data, potentially leaking sensitive information or influencing the client process, and corresponds to CWE‑125.

The flaw exists in all Linux kernel builds that include the default SMB client before the patch released on 24 April 2026. No specific affected version list is provided, so any kernel containing the affected code is susceptible; the CNA data lists Linux as the impacted vendor.

The CVSS score of 8.1 indicates a high‑severity condition, while the EPSS score of less than 1 % suggests that, as of now, exploitation is unlikely to be widespread. The vulnerability is not included in the CISA KEV catalog. Attackers would need to control an SMB server or trick a Linux client into requesting a symlink operation with a maliciously crafted error response; if such a server is reachable from the client, the out‑of‑bounds read can be triggered and data can be exfiltrated.