In Linux kernels that include the ksmbd SMBv3 server, a stack buffer overflow is possible during the session key copy phase for multichannel connections. The code incorrectly bounds the copy against a 40‑byte limit while the destination buffer is only 16 bytes, allowing up to 24 bytes of data to overflow the stack. This overflow can corrupt kernel memory and, if controlled by an attacker, can lead to arbitrary code execution or denial of service. The flaw is a classic buffer copy without bounds check and is classified as CWE‑120.

All Linux kernel releases that compile the ksmbd subsystem with multichannel support and contain the pre‑patch implementation. No specific version numbers are listed; it applies to any kernel prior to the commit that introduced per‑channel key sizing and bound checks.

The vulnerability is remotely exploitable over SMB connections that permit NTLM or Kerberos session key exchange. An attacker could craft a session key longer than 16 bytes to trigger the overflow. While no EPSS or KEV scores are available, the stack‑based nature and kernel context imply a high severity. The CVSS score is not provided, but the potential impact on confidentiality, integrity, and availability warrants immediate attention. If an exploitable path exists, an attacker could execute arbitrary code with kernel privileges by sending a malicious session establishment request to the affected SMB server.