The Linux kernel's ksmbd SMB server component had a flaw where the minimum SMB2 Protocol Data Unit (PDU) size check was only applied when the ProtocolId was SMB2_PROTO_NUMBER. Packets with SMB2_TRANSFORM_PROTO_NUM could bypass this check even if the negotiated dialect did not support transform handling. On SMB 2.1 connections, this allowed short transform packets to reach init_smb2_rsp_hdr(), which misinterpreted the packet as a full SMB2 header and read beyond the allocated buffer, potentially leaking data to unauthenticated clients. The fix converts compression transform packets to ordinary SMB2 messages before validation and enforces minimum PDU size checks and header requirements to reject truncated or malformed requests before processing.

An unauthenticated attacker could send specially crafted SMB2 transform packets that bypass minimum size validation, causing the server to read beyond allocated memory buffers. This could result in information disclosure of kernel memory contents to the attacker. No known exploits in the wild have been reported. The vulnerability affects SMB 2.1 connections where transform handling is not properly validated.

A fix has been implemented in the Linux kernel ksmbd component that enforces minimum PDU size validation for transform requests and rejects truncated requests before allocation. Users should apply the official kernel updates that include this fix. Since no patch links or vendor advisories are provided here, check the Linux kernel mailing lists or distribution security advisories for the relevant fixed kernel versions. No additional mitigations are indicated by the vendor advisory.