In the Linux kernel SMB client, the function smb3_enum_snapshots() can read more data than allocated when the server response is shorter than expected. This out‑of‑bounds read occurs before the data is copied to user space, allowing an attacker to expose adjacent memory contents. The flaw provides information disclosure but does not give direct code execution or denial of service, and it results from an improper boundary check of server‑supplied data. The issue is classified as CWE-125.

The vulnerability affects the Linux kernel’s SMB client implementation; any distribution that ships an unpatched kernel binary is at risk. No explicit version numbers are provided, so all kernels released prior to the patches cited in the advisory are potentially vulnerable.

The flaw is a classic out‑of‑bounds read; an attacker would need to control a SMB server that replies with a crafted, short snapshot array. The attack could be executed remotely if an SMB connection is accepted, or locally if the attacker can invoke the SMB client with a malicious server. The EPSS score is < 1%, indicating a very low publicly observable exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, meaning no publicly known exploits are currently documented. The patch resolves the issue by rejecting replies shorter than the 12‑byte minimal snapshot array size, which mitigates the memory leak entirely. The CVSS score is 7.1. The issue is classified as CWE-125.