By rewriting DACLs, the SMB client allocates a buffer based on the existing DACL size. If replacement SIDs are longer, the rewrite overflows the buffer, allowing an attacker to overwrite kernel memory. Based on the description, it is inferred that a crafted SMB response can trigger this overflow, potentially leading to arbitrary kernel code execution, privilege escalation, or a denial‑of‑service crash.

All Linux systems that use the CIFS SMB client in the kernel and have not yet applied the commit that allocates buffers for the worst‑case SID size are affected. This includes all kernel versions prior to the patched revision, regardless of distribution.

The vulnerability is a heap overflow in kernel space, with a high impact if exploited successfully, reflected by a CVSS score of 8.8. The EPSS score of < 1% indicates a very low likelihood of exploitation. No publicly available exploit was cited, and the absence of a CISA KEV listing suggests no known active exploitation. Based on the description, it is inferred that a remote attacker feeding crafted SMB traffic could trigger the buffer overflow, leading to kernel privilege escalation or a crash.