The Linux kernel's SMB client had an out-of-bounds read vulnerability in the smb2_compound_op() function. If a server sends a truncated response with a large OutputBufferLength and prematurely ends the EA list, the check_wsl_eas() function incorrectly returns success without verifying that the entire OutputBufferLength fits within the allocated iov_len buffer. Subsequently, smb2_compound_op() performs a memcpy using OutputBufferLength as the size, which can read beyond the rsp_iov allocation, potentially leaking adjacent kernel heap memory. This vulnerability has been resolved in patched kernel versions.

This vulnerability allows a remote attacker controlling an SMB server to cause the client to read beyond the bounds of allocated kernel memory, potentially leaking sensitive kernel heap data. The CVSS score of 9.1 indicates a critical confidentiality impact with no required privileges or user interaction. There is no indication of known exploits in the wild at this time.

A patch is available and should be applied. Users should update their Linux kernel to the fixed versions as provided by the vendor. After updating, a system reboot is required to apply the changes. Due to ABI changes, third-party kernel modules may need recompilation and reinstallation. Follow the vendor advisory for specific package versions and update instructions.