The Linux kernel SMB client allocates a security descriptor buffer with kmalloc, leaving a 2‑byte reserved field uninitialized. When that field contains slab garbage, Samba rejects the descriptor and the subsequent chmod operation fails with EINVAL, preventing permission modifications. This flaw does not grant privilege escalation or data exposure but can disrupt ACL updates, effectively causing a denial of service. The weakness arises from failure to enforce protocol requirements (CWE-909).

All Linux kernel releases prior to the commit 62e7dd0a39c2, which changes the allocation to kzalloc, are vulnerable. The issue affects any machine running a kernel with SMB client support that connects to a Samba server performing ACL changes, regardless of user privileges.

The flaw is local to the SMB client stack and requires the attacker to initiate ACL changes via SMB. The CVSS score of 7.0 indicates medium severity. The EPSS score is listed as < 1%, reflecting a very low likelihood of exploitation. The vulnerability is not present in the CISA KEV catalog, further suggesting it is unlikely to be actively exploited. Consequently, the risk is limited to disruption of permission changes rather than broader system compromise.