In the Linux kernel, the ksmbd SMB server had an issue where copying access control entries (ACEs) could stop early when a DACL size overflow occurred. The later deduplication routine still used the original NT ACE count, causing it to walk past the actual copied array and read from uninitialized memory. This out-of-bounds read can expose kernel data. Based on the description, it is inferred that an attacker could trigger the read by sending specially crafted SMB requests to ksmbd and potentially use the leaked data as a foothold for further exploitation.

All Linux kernel releases that include the ksmbd SMB server implementation before the patch are affected. The version details are not specified in the advisory, so any system running an affected kernel with ksmbd enabled is at risk.

The CVSS score of 8.8 indicates high severity for an out-of-bounds read (CWE‑125). The EPSS score is < 1 % and it is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves remote SMB traffic; an attacker would need network access to the ksmbd service and would need to send crafted SMB packets to provoke the faulty dedup walk. If successful, kernel memory could be read, potentially enabling further compromise.