Linux kernel's CIFS client does not validate string offsets supplied by an SMB server in DFS referral responses. The offsets used to locate DfsPath and NetworkAddress strings can point outside the buffer, resulting in an out‑of‑bounds read. Because the length is processed as a signed integer and then cast to an unsigned size_t, the kernel may duplicate an overflowed string, leading to kernel memory disclosure and potentially a crash. This flaw is a classic example of improper input validation (CWE‑20) that allows an attacker to read memory outside the intended bounds (CWE‑125).

All Linux kernel versions prior to the patch that contains the handled commit are affected. The vulnerability resides in the CIFS client that parses DFS referrals; no specific kernel version was listed, so any kernel prior to the commit identifiers referenced in the advisory must be updated. The CNA vendors list Linux as the affected vendor.

The CVSS score of 9.4 indicates a high severity. The EPSS score is < 1%, showing low publicly observed exploit probability. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is a malicious DFS referral sent from an SMB server to a CIFS client. If exploitation were achieved, an attacker could read kernel memory and potentially crash the client, leading to information disclosure or denial of service.