The vulnerability exists in the SMB client stack of the Linux kernel. It arises when the kernel validates the response to a PASSTHRU_FSCTL request. The 32‑bit OutputOffset and qi.input_buffer_length values are added together in 32‑bit arithmetic without checking for overflow. If a malicious SMB server specifies a large offset and a small output count, the wrapped sum can pass the bounds check and the subsequent copy_to_user() will read data beyond the end of the response buffer. The data that the kernel copies into userspace can contain privileged kernel memory, leading to information disclosure. The flaw does not directly allow code execution but can expose sensitive data that may aid further attacks.

The flaw is present in the Linux kernel, which underlies all Linux‑based systems. The known CNA vendor list indicates the issue affects the Linux operating system kernel itself. No specific upstream version numbers were provided in this advisory, so any kernel build preceding the commit that introduced the fix is potentially vulnerable.

The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires a malicious SMB server to send a crafted PASSTHRU_FSCTL response to a SMB client running on the target system. An attacker with the ability to act as an SMB server can trigger the overflow locally, resulting in an information‑leak that may be exploited as part of a larger compromise. The CVSS score of 8.1 indicates high severity for kernel‑level vulnerabilities. Because the issue resides in kernel code, it poses a moderate to high risk, especially in environments where SMB traffic is allowed from untrusted sources.