The Linux kernel’s SMB client code in CIFSSMBRead() interprets the length fields of a READ_RSP response without first verifying that the full response was received. A malicious or compromised SMB1 server can therefore send a truncated READ_RSP that causes the client to read past the end of its receive buffer. This out‑of‑bounds memory read can expose kernel memory contents or trigger a crash, leading to potential information disclosure or denial‑of‑service. The flaw is a classic buffer over‑read and involves invalid array index based on incomplete data (CWE‑125).

The vulnerability is present in the Linux kernel’s SMB client subsystem and applies to any host that mounts an SMB share using SMB1 with the explicit vers=1.0 option. No specific kernel release is listed in the data, so all kernel versions that implement SMB1 and have not been patched remain potentially affected. Hosts that never enable SMB1 are not directly impacted.

The EPSS score indicates a low likelihood of exploitation, with a score < 1%. It is not listed in the CISA KEV catalog. However, an attacker who can communicate with a client over the network and is able to force SMB1 usage could send a forged short READ_RSP and trigger the out‑of‑bounds read, which may crash the kernel or leak memory. Because SMB1 is not negotiated by default and requires an explicit vers=1.0 mount, the attack surface is limited, but the potential impact of a successful exploitation remains high.