This vulnerability occurs in the Linux kernel SMB client when parsing a share-root relative symlink. The implementation uses memcpy with a length larger by one byte, creating an out-of-bounds read. The result is a KASAN error, which can leak kernel memory or trigger a crash. The flaw is a classic buffer over-read, demonstrated by the KASAN splat when an SMB symlink target of '\\a\\b' is parsed.

All Linux kernel versions that include the smb client and have not yet incorporated this fix. The vulnerability is present in every upstream kernel before the patch commit that was merged in 2026. Because no specific releases are listed, any distribution with a pre‑fix kernel is potentially affected, regardless of vendor.

The EPSS score is <1%, indicating a very low probability of known exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the likely attack vector is a malicious SMB server sending a specially crafted symlink to a client over the network. An attacker that can cause the SMB client to parse the malformed link can force the kernel to perform a one‑byte over‑read, potentially leaking sensitive memory contents or crashing the host. The CVSS score of 5.5 marks it as moderate severity, so prompt patching is recommended.