The Linux kernel contains a bug in the SMB client DFS referral handling where the PathConsumed value is not validated against the length of the search name. If a malicious SMB server sends a PathConsumed value larger than the name being searched, subsequent DFS parsing can use that value as an offset and advance beyond the allocated path buffer. The resulting out‑of‑bounds memory access can corrupt kernel memory, potentially leading to a crash or providing a foothold for privilege escalation if the kernel runs with elevated privileges.

All Linux kernel installations that have not incorporated the commit resolving the flaw are affected. No specific version ranges are listed, so any kernel built before the patch is at risk and requires an update to a fixed release.

The bug carries a CVSS score of 9.1, indicating high severity, while the EPSS score is below 1 %, suggesting a very low but non‑zero likelihood of active exploitation. The flaw is not currently listed in the CISA KEV catalog. An attacker would need to act as an SMB server that returns a crafted DFS referral response; with such a setup, the vulnerability could cause a denial of service or privilege escalation on the target system.