A flaw in the Linux kernel SMB client has been identified where and target data pointers directly from the DataOffset fields supplied by the SMB server, without validating that the offset lies within the allocated buffer. This lack of bounds checks allows a malicious SMB server to supply a low offset that causes the target pointer to point below the buffer start, overwriting critical header fields, or a large offset that pushes the pointer beyond the buffer end, resulting in out‑of‑bounds memory reads or writes. Such overwrites can corrupt kernel memory or alter control flow, creating a path to arbitrary code execution. The weakness is formally categorized as CWE‑125, an out‑of‑bounds read/write vulnerability.

All Linux kernel builds that contain the original coalesce_t2() implementation and have not applied the patch are vulnerable. The flaw exists within the SMB client subprocess module, so any distribution that ships the unpatched kernel—whether as a server or host that acts as an SMB client—could be impacted. No specific version numbers are listed, but the presence of the vulnerable code in the core SMB client module covers every mainstream kernel release prior to the fix.

The malicious exploitation of this defect would require an SMB server that can supply crafted DataOffset values in T2 responses to a target that is acting as an SMB client. The CVSS score of 7.1 indicates a moderate to high severity risk. The EPSS score of 0. indicates a very low likelihood of exploitation and no current reports of public exploitation. Nevertheless, the vulnerability is not listed in CISA’s KEV catalog, a remote SMB connection presents a significant risk on systems that accept connections from non‑trusted networks or the internet.