The Linux kernel’s ksmbd service computes response message sizes by adding attacker‑controlled fields to fixed structure sizes using unsigned arithmetic. In three cases the addition or multiplication can wrap around, producing a message size that matches the expected value. The subsequent memcpy and kmemdup calls then trust this unverified length. This unchecked length can lead to kernel memory corruption which, though not explicitly stated, could result in denial of service or, if an attacker gains sufficient privileges, privilege escalation. The potential impact is therefore kernel memory corruption and the associated availability or confidentiality risks.

All Linux kernel builds that contain the ksmbd SMB server subsystem without the patch described in this advisory are affected. No specific kernel release identifiers are listed; thus any unpatched kernel that bundles ksmbd potentially exposes the flaw.

The CVSS score of 7.1 classifies this as a high‑severity vulnerability, while the EPSS score of <1% indicates a very low likelihood of exploitation in the current environment. The vulnerability is not listed in CISA KEV. The likely attack vector involves a remote attacker sending crafted SMB responses, but this inference is based on the nature of the component and is not directly confirmed in the description.