The Linux kernel SMB client contains a loop that processes symlink error data. When the error data length is close to the maximum 32‑bit value, the ALIGN() helper can overflow to zero. This causes the bounds check to pass and the loop to advance by zero bytes, leaving the internal pointer on stale data and allowing the kernel to read memory beyond the intended buffer. The flaw does not provide a direct path memory contents or trigger a kernel panic, affecting confidentiality and availability.

All Linux kernel distributions that include introduced by commit 7d9a7f1f96cd. The vulnerability applies to any kernel that has not incorporated this commit, regardless of the distribution, as it touches core SMB client code.

The CVSS score of 5.4 rates the issue as moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, implying no known active exploitation. An attacker would need to control an SMB server that can send an error packet with an ErrorDataLength near the 32‑bit maximum to a vulnerable SMB client. Successful exploitation would result in an out‑of‑bounds memory read, potentially exposing sensitive data or causing a denial of service.