The Linux kernel SMB client contained a long-standing quirk in smb2_check_message() that accepted responses whose calculated length was one byte larger than the bytes actually received, to accommodate servers omitting a trailing bcc[0] byte when no data area was present. However, this exemption was applied unconditionally, even when the response contained a data area. This caused the decoder to read past the end of the receive buffer, resulting in out-of-bounds reads detectable by KASAN during NEGOTIATE and SESSION_SETUP phases. The fix restricts the +1 length exemption to only responses without a data area, eliminating the out-of-bounds read condition.

The vulnerability causes out-of-bounds memory reads in the kernel SMB client during early SMB session setup phases. This can lead to kernel memory disclosure or instability due to reading beyond allocated buffers. The issue is triggered by malformed SMB responses from non-conforming servers. There are no known exploits in the wild. The impact is limited to the kernel SMB client component and occurs before session establishment.

A fix has been implemented in the Linux kernel to restrict the length exemption in smb2_check_message() to responses without a data area, preventing out-of-bounds reads. Users should apply the official kernel update that includes this fix. Since this is a kernel vulnerability, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly stated in the provided data; check the vendor or Linux kernel advisories for the exact fixed kernel versions and apply updates accordingly.