The SMB client in the Linux kernel fails to enforce bounds when parsing create-context structures in SMB2 requests. A malicious SMB server can craft a chain of contexts that causes the kernel to read memory beyond the intended bounds, potentially exposing adjacent kernel memory contents. Similar parsing errors in SMB2/SMB3 lease handling allow the kernel to interpret non‑canonical offsets, which can also lead to unintended data reads. These weaknesses ultimately enable an attacker to acquire sensitive information from the kernel, rather than execute code directly.

All Linux kernel installations that contain the SMB client component are potentially affected. No specific version range is provided, so any kernel that has not incorporated the upstream patch remains vulnerable. Systems running upstream kernels or backports lacking the fix are at risk, regardless of distribution.

The vulnerability does not provide direct remote code execution; its primary impact is confidentiality loss through out‑of‑bounds reads. The EPSS score is <1% and the issue is not listed in the CISA KEV catalog. The CVSS score is 8.1. While the lack of a direct execution path reduces immediate urgency compared to higher‑severity flaws, the potential to leak kernel memory makes swift mitigation desirable.