The ksmbd SMB server in the Linux kernel contains a signedness bug in smb_direct_prepare_negotiation(): an unsigned __u32 value derived from preferred_send_size is cast to a signed int before a min_t calculation. When an attacker supplies a malicious preferred_send_size of 0x80000000, the signed conversion treats it as a negative number, causing the function to select a lower maximum receive size. A subsequent SMB message that exceeds the enforced limit (more than 1420 bytes) will overflow a heap buffer. The resulting overwrite can compromise kernel memory and potentially allow arbitrary code execution or a system crash.

All Linux kernel releases that include the ksmbd SMB server component before the commit that implements the signedness bug fix. The exact vulnerable versions are not listed in this CVE record; users should compare their running kernel version against upstream patch commits, such as commit 55abc475d096da4a5356b6efb0cfdc6156bc1550, to determine vulnerability status.

Exploitation requires an attacker to reach the SMB service over the network, send a crafted negotiation request, and then transmit a large SMB message. The likely attack vector is remotely via the SMB port, and the CVSS score of 9.8 indicates a critical severity, while the EPSS score of <1% suggests a low current exploitation probability; however, the vulnerability remains unlisted in KEV. If the exploit succeeds, it could grant kernel-level code execution or cause a system crash.