The Linux kernel’s SMB client fails to validate the length of a buffer when handling a symlink error response. If a malicious SMB server returns only the minimal SMB2 header, the client reads beyond the supplied data, exposing adjacent memory contents. This out‑of‑bounds read (CWE‑119) is caused by improper input validation (CWE‑20) and can allow an attacker to read arbitrary memory, potentially leaking sensitive information or facilitating further compromise.

All Linux kernel instances that include the buggy SMB client code are affected until the fix is applied. The vulnerability resides in the SMB2 protocol handling in the kernel; no specific version range is supplied, so any kernel prior to the latest stable release that lacks the patch is vulnerable.

No CVSS or EPSS score is provided, and the flaw is not listed in the CISA KEV catalog, so the precise exploitation probability is unknown. The flaw requires a remote SMB server capable of sending a crafted symlink error response; thus, the attack vector is remote over SMB. While no documented exploits exist at this time, the ability to read memory beyond the boundary places the risk in a moderate‑to‑high category pending the availability of exploitation code.