The vulnerability in the Linux SMB client causes pages that extend beyond a file’s current end of file to remain cached after a zero‑range write. When the file is subsequently enlarged, these stale pages become visible as part of the file’s content, exposing data that was previously written past the file’s boundary. The issue is a vulnerability classified under CWE‑908 that can lead to confidential data disclosure.

Any Linux distribution that ships a kernel version before the fix is vulnerable, regardless of vendor. No explicit version range is listed, so all kernel releases preceding the commit that added the fix are affected.

With a CVSS score of 3.3 the vulnerability is considered low severity, and an EPSS score of < 1 % indicates a very low probability of exploitation. It is not listed in CISA’s KEV catalogue. Exploitation would require an SMB client performing a zero‑range file extension on a vulnerable host. The likely attack vector is remote via SMB traffic, although a local attacker who can manipulate SMB packets could also trigger the vulnerable operation. The potential impact is the unauthorized reading of data that was not intended to be part of the file’s contents.