The Linux kernel SMB1 client contains a flaw in CIFSSMBRead() that accepts a DataOffset value without validating it against the actual length of the SMB response. An attacker, acting as an SMB1 server, can send a response with a legitimate DataLength but a large DataOffset. The kernel then copies data starting beyond the end of the received response buffer, exposing adjacent kernel heap memory to the user‑land caller and potentially causing a kernel oops or crash. This results in information disclosure or denial of service. The weakness is an unchecked out‑of‑bounds read that corresponds to CWE-125.

This vulnerability exists in the SMB1 client path of the Linux kernel. The CVE data does not give a specific affected version range. Systems running a kernel that has not received the patch (which validates the DataOffset in CIFSSMBRead()) and that mount an SMB share with the vers=1.0 option are affected.

The vulnerability has a CVSS score of 7.0 and an EPSS score of less than 1 %, indicating a relatively low probability of exploitation in the wild. Despite that, it remains a high‑severity flaw that could be exploited by a compromised or malicious SMB1 server. Attack requires forcing the client to use SMB1 and manipulating DataOffset. Once achieved, an attacker can trigger memory leaks or crashes. The flaw is not listed in CISA KEV.