The flaw resides in the Linux kernel SMB client’s handling of DACL rewrites. The code that aggregates the new DACL size uses a 16‑bit accumulator that can wrap when the DACL exceeds 64 KB. This wrap changes the size field to an invalid value, causing an internal offset to point to an arbitrary position within the ACE array and corrupting the DACL data that is ultimately sent to the SMB server. The corruption does not trigger an out‑of‑bounds write because the buffer allocates for the worst‑case expansion; instead it silently corrupts the ACL payload. The primary weakness is an integer overflow (CWE‑190), leading to memory corruption and potential denial of service for the SMB server.

All Linux systems that ship a kernel version containing the vulnerable SMB client implementation are affected. The vulnerability applies to the Linux kernel’s SMB client component. Until the patch referenced in commit 2ef532a01f44687f5b95001e88247cf05bff9892 or later stable releases is applied, any distribution using the kernel before that commit is exposed.

The CVSS score of 5.5 indicates a medium severity, while the EPSS score of < 1 % implies a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation is known. The likely attack vector is a remote client that can control the DACL being sent to the SMB server; a malicious or compromised client can craft an oversized ACL to trigger the wrap. Although the risk of exploitation is low, environments that heavily rely on SMB file sharing should consider the risk moderate and act accordingly.