ksmbd in the Linux kernel has an oversight where the FileSystemControlFlags field of the FS_CONTROL_INFORMATION structure is never initialized. When an SMB2_GET_INFO_FILESYSTEM request is processed, the kernel reports 48 bytes of information but leaves the last four bytes unset. Because the underlying response buffer is zeroed only on allocation and subsequent requests can overwrite a previously written, but unreplied, buffer, a malicious client can trigger the transmission of residual data. This results in a memory disclosure vulnerability that may expose kernel data to the client, illustrating an instance of Improper Initialization leading to Information Exposure.

The Linux kernel component ksmbd is affected. No specific kernel version is listed in the advisory, so any kernel build that still contains the pre‑patch ksmbd code path is at risk. Administrators should examine the kernel source or audit the running kernel to determine if the commit that initializes FileSystemControlFlags (reference 03bb4338c3a7c3fc4decf699a35753f0891aab2a) has been applied.

The advisory does not provide a CVSS score, and the EPSS value is not available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no publicly documented exploits yet. Nevertheless, the flaw can be triggered remotely by an SMB2 client that communicates with a machine running ksmbd. An attacker must be able to send crafted compound requests to the SMB server; if successful, they may read small portions of kernel memory, potentially aiding further privilege escalation or data exfiltration. While exploitation risk is undetermined, the information leakage is consequential for a high‑privilege service.