The Linux kernel SMB client contains a quirk in smb2_check_message that allows a +1‑byte length adjustment for responses lacking a data area, to accommodate servers that omit the trailing bcc[0] byte. The exemption is applied unconditionally; when a response does include data, this results in the reported data length exceeding the actually received bytes, leading to an out‑of‑bounds read when the decoder processes the message. The out‑of‑bounds read can reveal kernel memory contents or cause a crash, effectively providing an information disclosure or denial‑of‑service vector. The weakness is an out‑of‑bounds read (CWE‑788).

The vulnerability is present in all Linux kernel builds that do not yet contain the smb2_check_message fix. It affects the CIFS SMB client path used when mounting SMB shares (mount.cifs) and similar operations. Users running any affected kernel version are potentially impacted.

The EPSS score is reported as <1% and the vulnerability is not listed in CISA KEV, indicating a low likelihood of real‑world exploitation. Nonetheless, an attacker who controls a malicious SMB server that returns an oversized response can trigger the out‑of‑bounds read during a NEGOTIATE or SESSION_SETUP request. The attack vector is remote, limited to clients that connect to the non‑conforming server, and may be mitigated by blocking traffic to suspicious SMB hosts or applying the kernel patch.