The Linux kernel SMB client contained a vulnerability in the coalesce_t2() function where DataOffset fields supplied by the server were used without validation to compute data pointers. This allowed crafted DataOffset values to cause out-of-bounds reads or writes by pushing pointers outside the valid buffer area. The vulnerability could lead to memory corruption by overwriting header fields or reading beyond buffer boundaries. The fix involved implementing boundary checks on these pointers before performing memcpy operations or modifying header fields.

This vulnerability could allow an attacker controlling SMB server responses to cause out-of-bounds memory reads or writes in the Linux kernel SMB client. This may result in memory corruption, potentially leading to denial of service or other undefined behavior. No known exploits in the wild have been reported. The exact impact depends on the context in which the SMB client is used and the privileges of the affected process.

A fix has been implemented that adds proper validation of DataOffset values to ensure data pointers remain within valid buffer boundaries before memory operations. Users should apply the official Linux kernel patches that address this issue once available. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.