The Linux kernel's SMB client contains a flaw in the function cifs_sanitize_prepath that allows an out‑of‑bounds read when the function receives an empty string or a string composed solely of delimiters. The code attempts to dereference a pointer before it has advanced, which can trigger a kernel segmentation fault. A crash of this nature results in a kernel panic and loss of service for components relying on the SMB client, effectively denying availability to affected users.

All Linux kernel builds that implement the SMB client module and include an unpatched implementation of cifs_sanitize_prepath are affected. The patch that resolves the issue is identified in the commit referenced by the kernel repository links; any kernel older than that commit is vulnerable, with no specific version number provided.

The CVSS score for this vulnerability is 8.8 and the EPSS score is less than 1%, indicating a low probability of exploitation. It is not listed in the CISA KEV catalog. The attacker would need to supply a path string that triggers the out‑of‑bounds read, which can be achieved by interacting with SMB client operations, either locally or remotely. Because the flaw results only in a crash rather than arbitrary code execution, the impact is limited to a denial of service, though it could be leveraged in a broader attack by causing instability in critical services.