The CIFSSMBSetEA routine copied an extended attribute value into the SMB request buffer without ensuring the value fit within the negotiated buffer size, creating a classic buffer overflow. An attacker able to issue a setxattr on an SMB1 mount can cause a kernel memory corruption event, potentially crashing the system or enabling local privilege escalation. The flaw is a classic write out‑of‑bounds error identified as a Buffer Overflow (CWE‑122).

Affected versions are all Linux kernel releases that ship the CIFS SMB client and expose the CIFSSMBSetEA path. The issue was identified for SMB1 mounts; newer SMB2/3 mounts are not impacted. Precise kernel versions are not stated, so all distributions using the default CIFS client should treat this as a risk until a relevant kernel update is applied.

The vulnerability requires a local user with permission to mount an SMB1 share and invoke setxattr. No network‑side attack vector is documented, so exploitation is local. The EPSS score is not available and the vulnerability is not listed in the KEV catalog, but the nature of the kernel memory overwrite makes it high severity from a security standpoint. An attacker could trigger a crash or use the corruption to gain root privileges if additional auxiliary exploitation steps succeed. Patches that add proper bounds checking and enforce the request size limit before memory copies effectively eliminate the risk.