The ksmbd component of the Linux kernel does not enforce the minimum SMB2 Protocol Data Unit size for transform requests. A packet that uses the SMB2_TRANSFORM_PROTO_NUM identifier bypasses the normal size validation even when the negotiated dialect does not support transforms. The kernel therefore interprets the truncated transform packet as a full SMB2 header, reads beyond the bounds of the allocated request buffer, and copies kernel data into the response. The unauthenticated client receives this leaked data, resulting in an information-disclosure vulnerability.

All Linux kernel builds that contain the ksmbd module prior to the fix are affected. This includes every distribution that ships a kernel with ksmbd and has not applied the patch that adds minimum PDU size validation for transform requests.

The CVSS score of 9.1 indicates a critical severity. The EPSS score of less than 1% suggests a very low probability of exploitation at the present time, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can trigger the flaw by transmitting a specially crafted short SMB2_TRANSFORM_PROTO_NUM packet over an SMB 2.1 session to a vulnerable system; no privilege escalation is required, which is inferred from the description’s mention of an unauthenticated client receiving leaked data.