The vulnerability is an out‑of‑bounds read in the Linux kernel’s ksmbd component caused by a dead code path in smb_check_perm_dacl() that allows a malicious SMB2_CREATE request to read two bytes past an allocated ACE structure. The read can expose kernel memory contents, potentially leaking sensitive data. The weakness is a classic bounds‑check failure (CWE‑125).

Any Linux kernel that does not include the patch commit d07b26f39246 is affected. Linux distributions shipping unpatched kernels—regardless of release—remain vulnerable because the commit was applied to ksmbd to correct the bounds check. Users should identify if their running kernel includes the fix or plan to upgrade to a version that incorporates it.

The CVSS score of 8.1 reflects a high-risk information‑disclosure flaw with a low exploitation probability (EPSS <1%). It is not listed in CISA’s KEV catalog. Based on the CVE description, it is inferred that an attacker only needs network reach to the ksmbd service and can trigger the flaw remotely via a malformed SMB2_CREATE message; privileged access is not required. The attack surface is therefore the SMB port, and the leaked data could aid further compromise.