In the Linux kernel, the ksmbd component incorrectly handles the copying of access control entries (ACEs) when the size accounting of a DACL overflows. The function that copies the ACEs stops early, but the later deduplication routine still iterates over the original count of NT ACEs, walking past the actually copied array and reading the uninitialized tail buffer. This out-of-bounds read can leak kernel memory contents and potentially enable more advanced exploitation techniques if the attacker can observe or manipulate the leaked data.

All Linux kernel releases that include the ksmbd SMB server implementation prior to the patch that fixes the deduplication bounds. The vulnerability is addressed at the kernel level and applies to any host running an affected kernel with ksmbd enabled.

The CVSS score for this weakness is not disclosed, but the vulnerability demonstrates a classic out-of-bounds read (CWE-125). The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Access to the ksmbd service, which is typically exposed to SMB clients, is required for exploitation; therefore the likelihood of remote exploitation depends on network exposure and the presence of privileged users. The attack would likely involve sending specially crafted SMB requests to trigger the faulty dedup walk and extract kernel memory.