The vulnerability involves the ksmbd service in the Linux kernel. When a client issues the FSCTL_DUPLICATE_EXTENTS_TO_FILE ioctl, the kernel passes the source file reference directly to vfs_clone_file_range or vfs_copy_file_range without verifying the SMB access mask on the source handle. As a result, a handle opened with only attribute access can be used to copy data from the source into a destination that the attacker can read. This permits the attacker to read file contents that the SMB protocol would otherwise restrict, leading to unauthorized data disclosure. The weakness is an improper access control flaw (CWE‑358).

Affected systems are Linux hosts running the kernel with ksmbd enabled that have not been patched to include the check for FILE_READ_DATA on the source handle. The specific kernel versions are not detailed in the advisory, so any kernel prior to the commit that introduced the guard is potentially vulnerable. The issue is confined to the ksmbd module and does not affect other SMB implementations in the kernel.

The CVSS score is 7.5, the EPSS score is listed as less than 1%, indicating a very low current exploitation probability. The vulnerability is not in the CISA KEV catalog. Exploitation requires an SMB session in which the attacker can open a source file with attribute or other non‑read permissions, then issue the duplicate‑extents ioctl. The target must be reachable over a network where SMB is exposed, and the attacker must be able to bypass regular file access controls. If exploited, the attacker could acquire sensitive data from files otherwise hidden by file permissions.