In the Linux kernel SMB client, the function move_smb2_ea_to_cifs() uses a loop condition that permits iteration when the remaining source size is insufficient to contain a complete smb2_ea_info structure. This can result in out‑of‑bounds reads of ea_name_length and ea_value_length. The patch adds a check that src_size is at least the size of the structure before any reads, rejects next_entry_offset values that are too small or would advance beyond the buffer, and changes the error returned to user space for malformed EA lists from a misleading “attribute not present” or “output buffer too small” to a clear “server protocol error”. The vulnerability is a classic out‑of‑bounds read that may leak data from the filesystem or server responses. An attacker could send a crafted SMB server response with a malformed EA list to trigger the vulnerability and obtain bytes that were not intended for the client.

Affected systems are Linux kernel implementations that have not yet incorporated the commit that fixes move_smb2_ea_to_cifs(). Specific version ranges are not provided in the advisory.

Risk and exploitability are significant because the flaw is a server‑initiated condition and does not require local privileges. The EPSS score is < 1% and the vulnerability is not listed in CISA KEV, yet the CVSS score of 5.5 indicates medium severity and the potential for remote information disclosure makes it a noteworthy flaw. An attacker who can control or influence an SMB server could trigger the out‑of‑bounds read, causing the kernel to return an EIO error; although this signals a protocol error, the vulnerable client can still read unintended data. Exploitation requires network access to the SMB client and a malicious or compromised SMB server.