The Linux kernel’s SMB client contains a flaw where the function smb2_compound_op() copies data into an output buffer using a length supplied by the server. When a server sends a truncated response and sets a large OutputBufferLength while prematurely terminating the EA list, the helper check_wsl_eas() incorrectly reports success without confirming that the entire length fits within the allocated iov buffer. As a result, memcpy() may read beyond the end of the rsp_iov allocation, leaking adjacent kernel heap memory. This out‑of‑bounds read compromises the confidentiality of kernel data, potentially exposing sensitive information to an attacker.

All Linux kernel builds that contain the vulnerable smb/client implementation are affected. No specific versions are listed in the CVE data, so any kernel that has not yet incorporated the patch commits (512d33b, 8d09328, 9b3af35, a16f70a, dffb44b) may be vulnerable. Users should confirm whether their running kernel includes these fixes.

The CVSS score is 9.1 and the EPSS score is below 1 %, indicating a modest but non‑negligible likelihood of exploitation. The vulnerability is not in CISA’s KEV catalog. The attack requires a malicious SMB server that can send a crafted truncated response; thus the likely vector is server‑initiated during normal SMB client communication. An attacker controlling the SMB server could use the memory disclosure to obtain kernel data that might aid further exploitation, although it does not provide immediate remote code execution.