The vulnerability arises when ksmbd converts SMB stream names to UTF-16; the terminator is always written, but the allocation logic reserves too little memory. When a stream entry exactly fills the 448‑byte small response buffer, the terminator is written two bytes beyond the allocated space, corrupting kernel memory. If successfully triggered, the overflow could cause a kernel crash or provide an attacker with an avenue to execute arbitrary code with kernel privileges, leading to denial of service or privileged escalation.

All Linux kernel installations that have not yet incorporated the commit which reserves additional UTF‑16 space are affected. No specific version range is listed, but the issue exists until the patch from the cited maintenance commits is merged into the running kernel.

The CVSS score is not provided, but a buffer overflow in kernel space is typically high‑severity. The EPSS score is not available and the vulnerability is not in the CISA KEV catalog, indicating no known active exploitation. The likely attack vector is remote, via the SMB protocol that ksmbd serves over the network. An attacker must craft a SMB request containing a stream name that exactly fills the buffer, which is achievable without authentication, so the risk remains substantial until patched.