An out‑of‑bounds write occurs in the Linux kernel’s coresight ultrasoc‑smb subsystem when an SMB sink operates as a perf AUX sink. The function smb_sync_perf_buffer() calculates a page index from the head pointer before normalizing it with the buffer size, so a head value that exceeds the AUX buffer can cause a write past the end of the dst_pages array. This kernel memory corruption could compromise confidentiality, integrity, and availability. The flaw is identified as CWE‑787. It is inferred that such corruption could potentially enable privilege escalation or denial‑of‑service, but the CVE text does not explicitly confirm these outcomes.

All Linux kernel releases that include the coresight ultrasoc‑smb component configured as a perf AUX sink are affected. No specific version numbers are provided, meaning current and future kernel builds that enable this subsystem may contain the vulnerability.

The CVSS score of 7.8 indicates a high severity finding. The EPSS score of less than 1 % shows a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The flaw is triggered when the SMB sink is used as a perf AUX sink, suggesting that an attacker would need to influence that configuration or supply a large head value. This likely requires local or elevated privileges, and the exact attack vector is not explicitly stated, so it is inferred from the description.