The bug exists in the Linux kernel SMB client. When a specially crafted SMB response contains an inflated error data length, the function symlink_data ends up looping forever or performing an out‑of‑bounds read. The infinite loop can stall the SMB client thread, effectively denying service, while the buffer over‑read can expose kernel memory contents. The code paths rely on unchecked values taken from the SMB packet.

The vulnerability affects the Linux kernel across all distributions that include the affected code. Any host that runs the kernel and processes SMB responses is potentially vulnerable. The precise kernel version range is not specified in the data, but the fix was committed in the mainline source tree and is included in subsequent releases.

The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available, indicating limited publicly documented exploitation. The CVSS score is not supplied, but the infinite loop and buffer over‑read present a notable risk of denial of service and modest information disclosure. Exploitation would require a malicious SMB server or client that can send the crafted packet, so an attacker needs network access to the target’s SMB endpoint. The fix is available through standard distribution updates.