The Linux kernel SMB client contains a flaw where overlapping data areas in SMB2 responses are not properly rejected. The length compatibility exception routed through bcc[0] can be unintentionally applied when the overlap handling clears the declared data length, allowing an attacker to craft a response that appears to have no data area. This misinterpretation can lead to kernel memory corruption during response processing, which, if exploited, could crash the system or enable higher‑privilege execution.

All Linux kernel releases that include the SMB client code path without the security fix are vulnerable, including the 7.2 rc3 kernel and earlier versions that have not integrated commit 53b7c271f06b. Public distributions that ship kernels without this commit remain at risk until updated.

The CVSS score is 9.1 and the EPSS score is less than 1%. The vulnerability is not yet listed in the CISA KEV catalog, indicating no confirmed public exploits. A malicious SMB2 response sent over the network to a vulnerable client is the likely attack vector; such a request would need to reach the host’s SMB client, but once accepted could trigger memory corruption or denial of service.