The Linux kernel’s SMB client includes a routine called modefromsid that applies a server‑provided security identifier (SID) sub‑authority value to a local file mode. In the affected code, this value was used without masking it to 07777, allowing files created or modified by the client to receive overly permissive permissions. The consequence is that a malicious SMB server could instruct the client to set file permissions that grant broader access than intended, potentially enabling unauthorized read, write or execution of files.

All Linux kernel releases that contain the SMB client component and predate the patch commit which correctly applies the 07777 mask are affected. This includes the generic Linux kernel and specific pre‑release versions such as 7.2 rc1 and rc2. The fix has been incorporated into newer kernel releases; systems still running older kernels should update to a version that contains the commit referenced in the advisory URLs.

The EPSS score of less than 1% indicates a very low probability that this flaw will be exploited in the wild. The CVSS score of 7.1 shows the potential for significant impact if used, and the vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation. The likely attack vector is network‑based, requiring a SMB server that can supply a crafted SID value; this inference is based on the description of the defect. Exploitation would allow the attacker to create or modify files with high permissions on the client, which could lead to privilege escalation or data tampering if the affected process runs with elevated rights.