The Linux kernel’s SMB client contains a function parse_dacl() that processes Access Control Entries (ACEs). When the SID of an ACE matches the special NFS mode SID, parse_dacl() assumes there are at least three sub‑authorities and reads sid.sub_auth[2] to obtain NFS mode bits. An attacker controlling an SMB server can send an ACE with only two sub‑authorities. The compare_sids() routine compares only the minimum number of sub‑authorities, so the ACE still matches the NFS mode SID. As a result, parse_dacl() reads past the end of the ACE structure, performing an out‑of‑bounds read that may expose kernel memory content to the SMB client, leading to information disclosure.

The issue affects all Linux kernels where the SMB client code is compiled and used. The fix is introduced in commit 2757ad3e4b6f9e0fed4c7739594e702abc5cab21, so any kernel revisions prior to this commit are vulnerable. Administrators should verify that their systems run a kernel version that includes this commit or later, such as the latest patched releases from the distribution’s kernel package.

The vulnerability is not listed in CISA KEV, and its EPSS score is <1%, indicating a low probability of exploitation. The CVSS score of 7.6 indicates a high severity issue. The flaw requires an attacker to supply malicious SMB traffic to a vulnerable client; therefore it is remotely exploitable through the network. While the initial impact may be limited to an out‑of‑bounds read, the information leakage could be leveraged to facilitate further attacks. The lack of publicly available exploitation data suggests a moderate risk, but the severity of this memory‑reading flaw warrants immediate patching.