The kernel contains a bug in the ksmbd Samba server component, where the smb2_get_ea() function applies 4‑byte alignment padding with memset() after writing each EA entry without checking if sufficient space remains. When an EA value exactly fills the remaining buffer, the subsequent padding writes 1–3 NUL bytes past the allocated boundary, overwriting adjacent kernel heap memory. The flaw can be triggered by a SMB client that issues a compound request which depletes the response buffer, allowing the OOB write to occur. The overflow can corrupt kernel memory, potentially enabling an attacker to gain higher privileges or crash the system. Based on the description, it is inferred that a specially crafted SMB request can exercise the bug.

Linux kernel builds that include the ksmbd component are affected. No specific kernel version list is provided, so all kernels before the commit that introduced the bounds check may be vulnerable.

The CVSS score is 9.8, and the EPSS score is < 1%, indicating a high‑severity vulnerability with low probability of exploitation. The flaw is a classic out‑of‑bounds write in kernel space, which could lead to privilege escalation or denial of service. There is no public exploit or KEV listing, but the remote SMB client could trigger the bug by sending a compound request that forces the alignment write to overflow.