The vulnerability allows an attacker-controlled SMB server to cause the Linux kernel client to read 16 bytes of kernel memory from an empty, truncated range blob. This out‑of‑bounds read can leak sensitive information from the kernel address space, potentially exposing secrets or facilitating further compromise. The flaw originates when the SMB2_ioctl routine interprets an error code as a truncated response and then incorrectly processes a zero‑length array. The result is a wild read that can be triggered by a specially crafted SMB response. Affected systems include Linux kernel users running unpatched mainline releases, specifically versions around 6.6.87.2 and earlier. The bug was reproduced on 6.6.87.2 by a malicious SMB2 server sending a STATUS_BUFFER_OVERFLOW with OutputCount equal to zero. Fixes for the flaw have been incorporated into later kernel commits and are available in newer kernel sources.

Affected systems are Linux kernel users on mainline releases, including version 6.6.87.2 and older. The flaw resides in the smb3_fiemap and SMB2_ioctl paths of the CIFS client. Systems running any unpatched copy of the Linux kernel that does not include the commit that fixes the fiemap wild read are vulnerable. There is no specific vendor beyond the upstream Linux kernel.

Risk and exploitability are uncertain due to the absence of an EPSS score, but the potential for kernel memory disclosure indicates a high confidentiality risk. The flaw is listed as not in the CISA KEV catalog, suggesting no confirmed exploitation at the time of disclosure. The likely attack vector is a remote SMB client interacting with a malicious or compromised SMB server, which is commonly present on enterprise networks. An attacker who can supply such a server could trigger the zero-length range response to read arbitrary kernel memory, potentially serving as a stepping stone for privilege escalation or further attacks.