The flaw exists in the Linux kernel SMB client, where an off‑by‑8 bounds check wrongly bases the limit on the EA header instead of the actual data block. This causes the code to read beyond the intended buffer during EA name or value comparison, resulting in a buffer under‑read. The vulnerability can expose up to 8 bytes of kernel heap memory to an attacker. The leak could be used to glean sensitive kernel data that might aid in building additional exploits such as privilege escalation.

Any Linux system that includes the standard SMB/CIFS client implementation is potentially affected. The affected line is in the generic smb client code and applies to all kernel releases that have not applied the specific commit cited in the CVE advisory. No narrower vendor or version restrictions are listed; therefore the entire Linux kernel family that handles SMB extended attributes is considered at risk.

The CVSS score of 7.1 denotes a moderate to high severity for information disclosure. The EPSS score of less than 1% indicates that, as of now, exploitation attempts are expected to be rare. The vulnerability is not listed in the CISA KEV catalogue. The most likely attack vector is a remote attacker who controls an SMB server and sends crafted EA data to a victim host that connects to that server. The exploit requires only the SMB client to be active and no additional privileges on the victim side.