The Linux kernel contains a flaw in the smb2_get_info_filesystem handling where the FS_OBJECT_ID_INFORMATION structure is only partially written. While the kernel zeroes the buffer on allocation, in compound SMB requests the area may be reused for subsequent replies. If a preceding command writes its reply and then fails, the buffer that follows is not fully cleared, causing the client to receive up to 31 bytes of data that it was not intended to see, including fragments of previous responses and an access denied error. This leakage can expose sensitive data from earlier SMB interactions, potentially revealing confidential information to an attacker. The primary impact is that a remote user who can send SMB compound requests to a vulnerable kernel can read portions of kernel memory that were not meant to be disclosed. The flaw arises from the system not fully initializing a buffer before transmitting it, which aligns with information disclosure weaknesses.

All Linux kernel installations that have not applied the ksmbd fix are affected. No specific kernel release versions are listed in the CNA data; thus, any distribution running a non‑patched kernel is potentially vulnerable.

The vulnerability does not have a publicly available EPSS score or KEV listing, indicating no known exploitation in the wild as of the last assessment. However, the attack vector is remote, leveraging the SMB protocol to construct compound requests. The potential for information disclosure is significant because the attacker can retrieve at least 31 bytes of unintended data. Without a CVSS score, the risk can be considered moderate to high, as successful exploitation could reveal sensitive data from prior SMB sessions.