The bug in the Linux SMB client code causes pages that extend beyond a file’s end of file to be left in the cache after a zeroed range is written. When the file is subsequently enlarged, those stale pages become visible as part of the file’s contents. An attacker who can influence this zero‑range operation could therefore read memory that was previously written past the file’s boundary, leading to unauthorized disclosure of sensitive data. This flaw corresponds to an out‑of‑bounds read vulnerability (CWE‑125).

The issue resides in the Linux kernel. Any distribution that ships the unpatched kernel is vulnerable, regardless of vendor. No specific version range is supplied, so all Linux kernel releases preceding the fix are affected.

The CVSS and EPSS metrics are unavailable, and the flaw is not listed in the CISA KEV catalogue. Exploitation would require the victim to run the vulnerable Linux kernel while establishing an SMB session that performs a zero‑range file extension. Thus the attack vector is likely remote through an SMB client, but a local attacker could also trigger the operation by manipulating SMB traffic directed at the host. The probability of exploitation is uncertain, yet the potential impact—confidentiality compromise of arbitrary data—makes the vulnerability significant.