The vulnerability exists in the SMB client component of the Linux kernel. The function reparse_buf_ptr() reads a 16‑bit field called ReparseDataLength before verifying that the supplied buffer contains the full fixed header. If a server delivers a response whose length is smaller than the header, the read occurs past the end of the received data, exposing kernel memory contents. This results in a buffer overread, classified as CWE‑125, and may lead to information disclosure or a kernel crash.

Any system running a Linux kernel that contains the SMB client logic without the patch is affected. The fix, added in commit 05f78e6cf34ea3a285053bd5999e08e8ac298bd5, is present in all kernel releases after that point. Systems using earlier kernel versions must be evaluated; no specific version range is supplied, so all kernels lacking the fix are at risk.

The CVSS score of 6.3 indicates medium severity, while the EPSS score of less than 1 % suggests a very low but non‑zero probability of exploitation. The flaw can be triggered by a malicious SMB server that sends a malformed response to the client, making the vulnerability a network‑based attack. Because it can lead to information disclosure or denial of service and is not listed in CISA’s KEV catalog, administrators should treat it as a medium‑severity kernel issue and prioritize remediation.