By rewriting DACLs, the SMB client allocates a buffer based on the existing DACL size. If replacement SIDs are longer, the rewrite overflows the buffer, allowing an attacker to overwrite kernel memory. A crafted SMB response can trigger this overflow, potentially leading to arbitrary kernel code execution or privilege escalation, or a denial‑of‑service crash.

All Linux systems that use the CIFS SMB client in the kernel and have not yet applied the commit that allocates buffers for the worst‑case SID size are affected. This includes all kernel versions prior to the patched revision, regardless of distribution.

The vulnerability is a heap overflow in kernel space, with a high impact if exploited successfully. No publicly available exploit was cited, and the EPSS score is not available, but the absence of a CISA KEV listing suggests no known active exploitation. Nonetheless, the older kernel code remains vulnerable; a remote attacker feeding crafted SMB traffic can trigger the buffer overflow, leading to kernel privilege escalation or a crash.