The vulnerability in the Linux kernel SMB client arises from CIFSTCon() using strnlen() bounded by the server's ByteCount minus two. When ByteCount is 0 or 1, this calculation results in a negative integer that converts to a large size_t, causing a wraparound in the __u16 bytes_left variable. This leads to cifs_strndup_from_utf16() reading beyond the allocated slab object (~16 KB), potentially exposing kernel memory contents to userspace via tcon->nativeFileSystem in /proc/fs/cifs/DebugData. The fix rejects any tree connect response whose byte area is smaller than two bytes, the minimum required for parsing.

This vulnerability could allow an attacker to cause an out-of-bounds read in kernel memory, potentially leaking sensitive information to userspace through the /proc filesystem. There is no indication of code execution or privilege escalation. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to reject tree connect responses with byte counts smaller than two bytes. Users should apply the official kernel update that includes this fix once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.