The Linux kernel SMB client incorrectly accepts a SESSION_SETUP response that is shorter than the required SMB2 PDU size when the SMB2 status code is non‑zero. After reading the truncated frame, the client parses fields from leftover data in a reused buffer, trusting a stale SecurityBufferLength value. This allows an attacker who controls the SMB server to induce the client to copy several kilobytes of data beyond the intended boundary and return that data to the server as part of an NTLMv2 AUTHENTICATE message. The result is a remote memory read that can expose kernel data or other sensitive information. The flaw does not immediately lead to code execution, but it can be leveraged for further attacks or to gather information for more advanced exploits.

All supported Linux kernels prior to the commit that introduced the minimum‑PDU check are vulnerable. The vulnerability is present in every stable Linux distribution version that includes a kernel older than the patched release. The issue affects the SMB client component of the kernel across all recognized Linux vendors.

Exact CVSS scores are not populated in the CVE record, but the vector requires a malicious SMB server and a Linux client that performs SMB authentication. The EPSS metric is not available, and the vulnerability is not listed in the CISA KEV catalog. Given the ability to read arbitrary kernel memory via a remote SMB session, the risk is considered high. A determined attacker can send crafted SMB2 packets to a vulnerable client to exfiltrate data used for further reconnaissance or to facilitate other attacks.