The Linux kernel contains a flaw in the SMB client where a symlink with an absolute target can bypass normal NT drive prefix checks. When the symlinkroot is unset, the target is copied without conversion, and subsequent code assumes an NT prefix is present. This mismatch causes out‑of‑bounds writes into the internal buffer for the symlink path, eventually leading to a large memcpy that overflows a 24‑byte buffer. An attacker who can write to a shared folder can trigger the overflow and potentially gain arbitrary code execution in kernel space.

Linux kernel, any distribution version that incorporates the vulnerable SMB client code before the patch. The specific product is the core Linux kernel; affected Linux distributions are implied by the inclusion of the kernel code but no particular vendor or version was explicitly listed.

The vulnerability can be exploited by any user with write privileges on a SMB share that the client mounts. The CVSS score of 7.8 marks this as a high‑severity issue. They can craft a symlink with an absolute target; the client copies the target without ensuring an NT drive prefix, causing subsequent code to miscalculate offsets and underflow the length calculation, which in turn leads to a 24‑byte buffer overflow via a large memcpy. An attacker who succeeds in triggering this overflow could achieve code execution in kernel space and thus root privileges. The EPSS score of <1% indicates a very low probability that the flaw is currently being exploited, and the vulnerability is not yet listed in the CISA KEV catalog, suggesting no publicly known widespread exploitation. Nevertheless, the kernel‑level buffer overflow warrants immediate mitigation through patching.