In the Linux kernel, the SMB2_read() function copies a number of bytes from a response buffer based on the DataLength field supplied by a server without confirming that the DataLength and DataOffset values stay within the bounds of the actual response received. This flaw can cause the kernel to read beyond the allocated buffer, leading to a KASAN slab-out-of-bounds error and potentially corrupting kernel memory, which constitutes a CWE-125 vulnerability. The consequence is a serious memory corruption that can result in a kernel crash or denial of service.

The vulnerability affects the Linux kernel on any distribution that includes the vulnerable SMB client code prior to the patch. No specific version range is given, so all kernel releases before the update containing the fix are at risk.

An attacker who can establish an SMB session with the victim must control a SMB server capable of sending a crafted READ response. The flaw allows the kernel to copy a server-supplied DataLength that may exceed the actual received data, which can trigger kernel memory corruption. EPSS score is not available and the flaw is not listed in the CISA KEV catalog, but the remote nature of the attack and the severity of the potential memory corruption qualify it as high to critical risk.