The bug in ksmbd's set_ntacl_dacl function allows an authenticated SMB client to supply a malformed DACL with an oversized sub-authority count; the kernel then copies the ACE without checking the count, leading to a 1‑KB out-of-bounds read of heap memory that an attacker can fully control. This disclosure of kernel data can be viewed as an information‑exposure vector that may aid further attacks such as privilege escalation.

Affected releases of the Linux kernel that build the ksmbd SMB server prior to the included patch are impacted; all distributions that ship an unpatched kernel with ksmbd enabled may be vulnerable. The weakness appears in the kernel source tree and is not confined to a particular vendor, but only the Linux kernel product is listed.

The vulnerability requires the attacker to be authenticated and to send SMB2_SET_INFO with a DACL; no privilege escalation is directly supplied by the bug itself. Exploitability depends on the presence of ksmbd and SMBv2 support, and the lack of a CVSS score or EPSS data limits precise risk quantification. Nevertheless the out-of-bounds read of heap data that is fully controllable could provide valuable information to a malicious user, and the risk is therefore considered moderate to high in environments where SMB access is exposed to untrusted clients.