This vulnerability arises in the Linux kernel SMB client when the smb2_ioctl_query_info() routine copies a variable‑length server response to userspace without verifying that the buffer length fits within the actual allocated response. A malicious SMB server can provide an OutputBufferLength larger than the actual data payload, causing copy_to_user() to read past the end of the buffer and expose adjacent kernel heap contents to a user process. The flaw leads to an out‑of‑bounds read that can disclose sensitive kernel memory, which is a serious confidentiality risk (CWE‑125).

All Linux kernel systems that include the SMB2 client are affected. The vulnerability is present in the kernel’s SMB2 implementation before the patch referenced in the advisory. Specific vendor‑version information is not enumerated, so any kernel build that contains the unpatched smb2_ioctl_query_info() code is potentially vulnerable.

The probability of exploitation is not quantified (EPSS not available) and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 7.0 indicates a high severity, aligned with the kernel memory disclosure risk. However, the flaw can be exploited remotely whenever a Linux host communicates with a malicious SMB server: the attacker controls the SMB response, so a remote SMB server can trigger the OOB read. The lack of bounds checking in the client code creates a straightforward attack path for an attacker with SMB access.