The Linux kernel SMB client has a flaw that causes the server->total_read variable to be set incorrectly when processing compound encrypted PDUs. Instead of reflecting the size of each individual sub‑PDU, it retains the full decrypted frame size. This misalignment leads the SMB protocol layer to validate a sub‑PDU’s length against the entire frame, allowing a truncated non‑last sub‑PDU to bypass the guard and trigger an out‑of‑bounds read in smb2_get_data_area_len(). The affected read can expose sensitive kernel data or crash the system, resulting in information disclosure or denial of service.

Any Linux system running a kernel version prior to the application of the patch associated with commit 282b72f9a7ef31296c48366db4128882999cc048 is vulnerable. The vulnerability resides in the SMB2 client implementation that is part of the core kernel; no separate vendor product list is required beyond the kernel itself.

The CVSS score of 7.0 reflects substantial technical impact, but the EPSS score of <1% shows a very low current exploitation probability and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to initiate or manipulate an SMB session, crafting a compound encrypted frame that truncates a non‑last sub‑PDU. The attack vector is network‑based SMB traffic, typically on port 445. While no public exploits have been reported, the potential for kernel memory leakage or a crash warrants prompt remediation.