The vulnerability arises from a logic error in the SMB client’s data offset validation routine. A counter intended to bound the DataOffset field became zero due to a subtraction that wrapped, so the check no longer rejects out‑of‑range values. This allows a malformed SMB message to trigger a buffer‑under‑read within the kernel, potentially exposing sensitive memory contents. The flaw is a classic out‑of‑bounds read (CWE‑125). The impact is primarily confidentiality loss, with the possibility of disrupting the SMB client process.

All Linux kernel implementations that received the buggy code path, before the upstream fix was merged. The exact kernel versions are not enumerated in the advisory, so any kernel containing the commit sequence that introduced the bug is susceptible until the patch commit reintroduces proper bounds checking.

The CVSS score of 6.3 places the issue in the medium severity range. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the KEV catalog, implying no confirmed public exploits. Attackers would need to craft a specially structured SMB packet and, which suggests a remote attack vector via SMB. Given the low EPSS probability and lack of KEV listing, the current likelihood of exploitation in the wild is low, but vigilance remains prudent.