A critical vulnerability in the Linux kernel SMB client allows unauthenticated remote attackers to trigger memory issues via specifically crafted SMB2 responses, posing a significant risk to system availability and data confidentiality.

The flaw exists in the SMB2 client implementation within the Linux kernel, specifically within the __smb2_calc_size function. An attacker can send a crafted SMB2 response containing overlapping data areas that bypasses existing length validation, allowing the client to process invalid data as if it were legitimate.

The vulnerability carries a CVSS score of 9.1, reflecting its critical nature due to the lack of required authentication and the potential for remote exploitation. Successful exploitation can lead to a denial of service (system crash) or the unauthorized disclosure of sensitive information residing in memory. Organizations relying on SMB for file sharing and network communication are at heightened risk of service disruption and data exposure.

Immediate Action: Apply the latest security patches provided by your Linux distribution maintainer to ensure the kernel includes the fixes for the identified SMB2 client commits.

Proactive Monitoring: Monitor system logs for kernel panics or repeated SMB connection errors that may indicate an attempt to exploit this flaw.

Compensating Controls: Utilize network segmentation to restrict access to SMB services to trusted internal networks, effectively reducing the attack surface available to remote, unauthenticated actors.

Public Exploit Available: No

Due to the critical severity and the potential for unauthenticated remote exploitation, this vulnerability should be prioritized for immediate remediation. Administrators must identify systems running affected Linux kernels and apply the corresponding upstream fixes or vendor-supplied security updates as soon as they become available. Failure to patch may expose critical infrastructure to remote attacks.