The Linux kernel SMB client had a vulnerability due to the use of kmalloc() for allocating the security descriptor buffer without zero-initialization. Specifically, the reserved 2-byte field in the SMB ACL descriptor was left uninitialized, potentially containing non-zero slab memory garbage. This caused Samba to reject the security descriptor with a 'Range Error', leading to chmod failures with EINVAL. The fix involved switching to kzalloc(), which zeroes the entire buffer, preventing this issue. This vulnerability affects Linux kernel versions before 7.0.0-28.28.1.

The vulnerability causes denial of service in the form of failed chmod operations on SMB shares due to Samba rejecting malformed security descriptors. There is no impact on confidentiality or integrity, but availability is affected as chmod operations fail with an error. No known exploits are reported in the wild.

An official fix is available in Linux kernel version 7.0.0-28.28.1 and later, which uses kzalloc() to zero-initialize the security descriptor buffer. Users should update to this or a later kernel version to remediate the issue. No additional mitigation steps are indicated.