The Linux kernel’s SMB client processes POSIX directory attributes sent by SMB servers. In the function cifs_posix_to_fattr(), the return value of posix_info_parse() is ignored. When a server sends a malformed entry—such as invalid SID lengths—the parse function returns –1 and does not populate the parsed.owner and parsed.group fields. The code then passes these uninitialized values to sid_to_id(), which creates a SID string and forwards it to request_key(), leaking kernel stack contents to the userspace idmap daemon. The flaw thus permits disclosure of sensitive kernel data to an attacker who can influence SMB traffic.

The vulnerability affects the Linux kernel, specifically the SMB client module. No specific kernel version range is listed, so any kernel build that includes the unpatched SMB client is potentially impacted.

The EPSS score is reported as < 1%, indicating a very low but non‑zero probability of exploitation. The CVSS base score of 5.5 reflects a moderate impact. The vulnerability is not listed in the CISA KEV catalog. An attacker who can establish SMB communication with the vulnerable client can trigger the flaw and export kernel stack contents to userspace, potentially exposing confidential information. The likely attack vector involves a malicious or compromised SMB server sending crafted directory entries to a client that maintains the vulnerable code path.