The Linux kernel’s SMB client code in CIFSSMBRead() interprets the length fields of a READ_RSP response without first verifying that the full response was received. A malicious or compromised SMB1 server can therefore send a truncated READ_RSP that causes the client to read past the end of its receive buffer. This out‑of‑bounds memory read can expose kernel memory contents or trigger a crash, leading to potential information disclosure or denial‑of‑service. The flaw is a classic buffer over‑read (CWE‑119) caused by improper input validation (CWE‑20).

The vulnerability is present in the Linux kernel’s SMB client subsystem and applies to any host that mounts an SMB share using SMB1 with the explicit vers=1.0 option. No specific kernel release is listed in the data, so all kernel versions that implement SMB1 and have not been patched remain potentially affected. Hosts that never enable SMB1 are not directly impacted.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that no widespread exploitation has been reported. However, an attacker who can communicate with a client over the network and is able to force SMB1 usage could send a forged short READ_RSP and trigger the out‑of‑bounds read, which may crash the kernel or leak memory. Because SMB1 is not negotiated by default and requires an explicit vers=1.0 mount, the attack surface is limited, but the potential impact of a successful exploitation remains high.