This vulnerability exists in the Linux kernel SMB client when the server supplies an unvalidated dacloffset value. On 32‑bit builds the offset can be set near the maximum unsigned 32‑bit value, making the calculated DACL pointer wrap under the end of the security descriptor. Subsequent boundary checks are bypassed, allowing the client to dereference DACL fields from the wrapped pointer during permission‑change code paths such as chmod or chown. The result is kernel memory corruption that can crash the system or enable arbitrary code execution. The weakness is an integer overflow and buffer overflow (CWE-190, CWE-787).

All 32‑bit Linux kernel installations that use the SMB client to communicate with servers are affected until the patch that adds numeric validation of dacloffset is applied.

The CVSS score of 9.8 indicates a severe impact, but the EPSS score of <1% suggests that exploitation in the wild is currently unlikely. An attacker can trigger the flaw from an unauthenticated remote SMB server simply by sending a large dacloffset field in a security descriptor. Because the flaw is exploited through a remote service, it poses a remote denial‑of‑service risk and is not listed in CISA KEV.