The Linux kernel's SMB client had a vulnerability in the symlink_data() function where, on 32-bit architectures, specific error data length values could trigger an infinite loop or an out-of-bounds read. Specifically, when p->ErrorDataLength is 0xfffffff8, the code enters an infinite loop due to pointer arithmetic resulting in a self-referential pointer. When p->ErrorDataLength is 0xfffffff0, an out-of-bounds read occurs by accessing memory before the structure pointer. This vulnerability has been fixed in Linux kernel versions 7.0.0-28.28.1 and later.

The vulnerability can lead to a denial of service (DoS) condition due to an infinite loop and potential memory corruption from an out-of-bounds read. The CVSS vector indicates high confidentiality impact and high availability impact, with no integrity impact. The vulnerability is remotely exploitable without privileges but requires user interaction. There are no known exploits in the wild at this time.

A fix is available in Linux kernel versions 7.0.0-28.28.1 and later. Users and administrators should upgrade affected Linux kernel versions to at least 7.0.0-28.28.1 to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.