The Linux kernel’s SMB client contains a function parse_dacl() that processes Access Control Entries (ACEs). When the SID of an ACE matches the special NFS mode SID, parse_dacl() assumes there are at least three sub‑authorities and reads sid.sub_auth[2] to obtain NFS mode bits. An attacker controlling an SMB server can send an ACE with only two sub‑authorities. The compare_sids() routine compares only the minimum number of sub‑authorities, so the ACE still matches the NFS mode SID. As a result, parse_dacl() reads past the end of the ACE structure, performing an out‑of‑bounds read. This bug can expose kernel memory content to the SMB client and potentially crash the client or be leveraged to read arbitrary memory, leading to information disclosure or denial of service.

The issue affects all Linux kernels where the SMB client code is compiled and used. The fix is introduced in commit 2757ad3e4b6f9e0fed4c7739594e702abc5cab21, so any kernel revisions prior to this commit are vulnerable. Administrators should verify that their systems run a kernel version that includes this commit or later, such as the latest patched releases from the distribution’s kernel package.

The vulnerability is not listed in CISA KEV and no EPSS score is available, indicating that publicly known exploits are not yet documented. The CVSS score of 7.0 indicates a high severity issue. The flaw requires an attacker to supply malicious SMB traffic to a vulnerable client; therefore it is remotely exploitable through the network. While the initial impact may be limited to an out‑of‑bounds read, an attacker could potentially use the information leakage to facilitate further attacks. The lack of publicly available exploitation data suggests a moderate risk, but the severity of a memory corruption bug warrants immediate patching.