The vulnerability in the Linux kernel’s SMB client occurs in the modefromsid routine, where a server‑provided security identifier (SID) sub‑authority value is applied to a local file mode without the required 07777 mask. This oversight can cause files to be created or modified with excessively permissive permissions, potentially allowing privileged access or modification that the client should not grant. The defect can therefore facilitate unauthorized privilege escalation or data tampering by manipulating file permissions through a malicious SMB server.

All Linux kernel configurations identified as "Linux:Linux" that include the SMB client component are affected. The issue persists in kernel releases released before the patch commit that introduced the correct masking; the patch is available in newer kernel versions that have incorporated the commit referenced in the advisory URLs.

The EPSS score of less than 1% signals a very low probability of exploitation in the wild. The CVSS score of 7.1 indicates high severity, but the vulnerability is not listed in the CISA KEV catalog, which together imply that the overall risk to exposed systems is still modest. Exploitation would require an SMB server that can provide a crafted SID value, so the attack vector is network‑based to systems that actively use the SMB client. Given the narrow scope and low exploitation likelihood, the risk remains low for most deployments, though the potential impact of unlawful file permissions could be significant if exploited.