A buffer overflow is introduced in the SMB client code when constructing DACL pointers from a server‑supplied dacloffset value. Because the offset is not validated, a 32‑bit client can receive a value just below the maximum of an unsigned 32‑bit integer, causing the calculated pointer to wrap below the end of the security descriptor. Subsequent bounds checks are bypassed, allowing the client to dereference memory that is not part of the descriptor. The effect is a kernel memory corruption that can crash the system or potentially lead to execution of arbitrary code. This flaw is a classic case of buffer overflow leading to out‑of‑bounds access (CWE‑787).

All 32‑bit builds of the Linux kernel that use the SMB client to communicate with servers are affected. The flaw occurs during permission changes via chmod or chown operations processed by the SMB client. No specific kernel release numbers are listed; therefore any 32‑bit kernel version that has not yet integrated the patch from the referenced commit is potentially vulnerable.

Although the CVSS score is 9.8 and the EPSS entry is < 1%, the flaw can be triggered by an unauthenticated remote SMB server; the server simply needs to transmit a large dacloffset field in a security descriptor. The vulnerability was addressed in kernel patches linked in the advisory, but no KEV listing indicates that it has been widely exploited in the wild yet. Nevertheless, a local or privileged process could experience a denial‑of‑service or memory corruption if the SMB client is used to contact an untrusted server. Immediate patching or restriction of SMB traffic is advised to mitigate the risk.