Technical impact
The vulnerability resides in the CIFS client of the Linux kernel. It arises when parsing SMB reparse point replies: the code checks that the start pointer is before the buffer end but does not verify that the remaining data contains the full 8-byte header of the reparse_data_buffer structure. If an SMB server supplies a DataOffset that leaves fewer than eight bytes, the check succeeds and the kernel later reads ReparseTag and ReparseDataLength beyond the allocated buffer, resulting in an out-of-bounds read of kernel memory. This read can expose internal kernel data, providing an attacker with information disclosure but does not modify memory, so it does not directly lead to privilege escalation.
Affected Systems
All Linux kernel builds labeled simply as "Linux:Linux" are affected. The CNA data does not specify a version range, so any kernel prior to the commit that introduced the reparse buffer guard is considered vulnerable. Administrators should verify whether their running kernel incorporates the fix by checking the kernel's commit history for the referenced changes (e.g., commits 3d67f155, 5f0306e7, 8dc5db3a, d1152c96).
Risk and Exploitability
The CVSS score of 5.5 denotes a moderate risk. The EPSS score is below 1%, and the vulnerability is not listed in CISA’s KEV catalog, indicating very limited known exploitation. An attacker would need control of an SMB server that can send a malformed reparse point response, making the attack vector remote via SMB. Since only an out-of-bounds read is performed, exploitation would be limited to gathering data; no direct modification of kernel memory or escalation is possible with this flaw alone.
Debian DLA
Debian DSA
Ubuntu USN