In the Linux kernel’s ksmbd component, an out‑of‑bounds read occurs when the kernel parses a security descriptor’s DACL. The kernel checks the ACE header size but does not verify that the declared number of sub‑authorities fits within the size of the ACE record. A crafted ACE that declares a non‑zero sub‑authority count while its size field is too small causes the compare_sids function to dereference bytes beyond the allocated security descriptor. This results in a kernel heap over‑read. The flaw is a classic buffer over‑read (CWE‑125) with the potential to disclose kernel memory; the specific data that could be read is not detailed in the description, so the confidentiality impact is inferred from the nature of the read.

The issue applies to any Linux kernel that incorporates the ksmbd module prior to the patch that added the missing boundary check. Most mainstream distributions ship ksmbd as part of the base kernel. Precise kernel version numbers are not listed in the advisory, so administrators should verify whether their kernel includes the fix by checking vendor release notes or the upstream commit that introduced the patch.

The CVSS score of 8.1 places this flaw in the high‑severity range, while an EPSS score of less than 1 % indicates that exploitation attempts are currently rare. The vulnerability is not listed in CISA’s KEV catalog. An attacker must authenticate to an SMB share that allows modification of the security.NTACL attribute via SMB2_SET_INFO. By submitting a malformed ACE (size 16 bytes but with a non‑zero sub‑authority count) at the tail of the security descriptor, the attacker can cause the kernel to read past the allocation during a subsequent SMB2_CREATE operation, exposing kernel memory. The described exploit path requires only authenticated SMB access and does not grant code execution or elevation of privilege beyond the data that may be read.