This vulnerability arises in the Linux kernel SMB client when the smb2_ioctl_query_info() routine copies a variable‑length server response to userspace without verifying that the buffer length fits within the actual allocated response. The client clamps qi.input_buffer_length to the server‑reported OutputBufferLength, but does not check that the flexible‑array payload actually fits within rsp_iov[1].iov_len, allowing a malicious SMB server to provide an OutputBufferLength larger than the actual response. The copy_to_user call then reads past the end of the buffer and exposes adjacent kernel heap contents to the user process, leading to a kernel memory disclosure. This out‑of‑bounds read is a confidentiality breach linked to CWE‑125 and CWE‑805.

Any Linux system that ships the unpatched SMB2 client in its kernel is potentially vulnerable. The flaw exists in all kernel builds that include the legacy smb2_ioctl_query_info() implementation prior to the commit that mitigates the bounds check. Since the SMB client is part of the core kernel, the vulnerability is vendor‑agnostic and applies to all distributions that have not applied the patch.

Based on the description, it is inferred that a remote attacker can exploit the vulnerability by controlling the SMB traffic to a victim host. The likely attack vector is a malicious SMB server that returns a crafted response with an inflated OutputBufferLength. The EPSS score of less than 1% indicates a very low probability of exploitation overall, but the CVSS score of 8.1 demonstrates high severity. The flaw is not listed in CISA’s KEV catalog. Attacks would require the victim to initiate an SMB connection to the attacker’s server to trigger the out‑of‑bounds read, making the attack feasible against any SMB user or service that connects to untrusted servers.