A vulnerability in the Linux kernel SMB client allows acceptance of short SESSION_SETUP responses that lack required fields. This causes the parser to read stale data from a reused buffer, potentially leaking up to about 64 KB of memory back to the server during NTLMv2 authentication. The issue affects all supported stable kernel trees and was reproduced on version 6.6.87.2. The vulnerability has been resolved by rejecting short SESSION_SETUP responses and validating buffer lengths before processing.