In the Linux kernel ksmbd module, a compound SMB2 request is read without first verifying that the compound element is large enough to contain the StructureSize2 field at offset 64. This oversight causes a read of two bytes that extend past the receive buffer, resulting in a slab‑out‑of‑bounds read. The flaw does not provide arbitrary code execution but exposes internal kernel memory to a remote attacker, potentially revealing sensitive data. The weakness is a classic out‑of‑bounds read (CWE‑125).

The vulnerability affects the ksmbd SMB2 server component of the Linux kernel. Any Linux distribution shipping a kernel that lacks the patch found in commit 15b38176fd1530372905c602fde51fe89ec8c877 (and the subsequent referenced commits) is impacted. This includes all kernel versions prior to the application of that patch on the affected distro’s update channel.

The CVSS score is not provided, but the nature of the vulnerability suggests a high severity. The likelihood of exploitation is potentially significant in environments with exposed SMB services and without timely kernel updates.