The kernel contains a bug in the ksmbd Samba server component, where the smb2_get_ea() function applies 4‑byte alignment padding with memset() after writing each EA entry without checking if sufficient space remains. When an EA value exactly fills the remaining buffer, the subsequent padding writes 1–3 NUL bytes past the allocated boundary, overwriting adjacent kernel heap memory. The flaw can be triggered by a SMB client that issues a compound request which depletes the response buffer, allowing the OOB write to occur. This overflow can corrupt kernel memory, potentially enabling an attacker to gain higher privileges or crash the system. Based on the description, it is inferred that a specially crafted SMB request can exercise the bug.

Linux kernel builds that include the ksmbd component are affected. No specific kernel version list is provided, so all kernels before the commit that introduced the bounds check may be vulnerable.

The CVSS score is not reported, and the EPSS score is unavailable, leaving the quantitative risk uncertain. The vulnerability represents a classic out‑of‑bounds write in kernel space, which is a high‑severity flaw. Since the flaw lies in low‑level kernel code and can corrupt privileged memory, it potentially allows an attacker to achieve privilege escalation or denial of service. The lack of a public exploit or KEV listing suggests limited but plausible attack exposure. The likely attack vector is a remote SMB client sending a compound request that forces the alignment write to overflow.