In the Linux kernel, the following vulnerability has been resolved:
smb3: fix for slab out of bounds on mount to ksmbd
With KASAN enabled, it is possible to get a slab out of bounds
during mount to ksmbd due to missing check in parse_server_interfaces()
(see below):
BUG: KASAN: slab-out-of-bounds in
parse_server_interfaces+0x14ee/0x1880 [cifs]
Read of size 4 at addr ffff8881433dba98 by task mount/9827
CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G
OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary)
Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
Hardware name: Dell Inc. Precision Tower 3620/0MWYPT,
BIOS 2.13.1 06/14/2019
Call Trace:
<TASK>
dump_stack_lvl+0x9f/0xf0
print_report+0xd1/0x670
__virt_addr_valid+0x22c/0x430
? parse_server_interfaces+0x14ee/0x1880 [cifs]
? kasan_complete_mode_report_info+0x2a/0x1f0
? parse_server_interfaces+0x14ee/0x1880 [cifs]
kasan_report+0xd6/0x110
parse_server_interfaces+0x14ee/0x1880 [cifs]
__asan_report_load_n_noabort+0x13/0x20
parse_server_interfaces+0x14ee/0x1880 [cifs]
? __pfx_parse_server_interfaces+0x10/0x10 [cifs]
? trace_hardirqs_on+0x51/0x60
SMB3_request_interfaces+0x1ad/0x3f0 [cifs]
? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs]
? SMB2_tcon+0x23c/0x15d0 [cifs]
smb3_qfs_tcon+0x173/0x2b0 [cifs]
? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs]
? cifs_get_tcon+0x105d/0x2120 [cifs]
? do_raw_spin_unlock+0x5d/0x200
? cifs_get_tcon+0x105d/0x2120 [cifs]
? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs]
cifs_mount_get_tcon+0x369/0xb90 [cifs]
? dfs_cache_find+0xe7/0x150 [cifs]
dfs_mount_share+0x985/0x2970 [cifs]
? check_path.constprop.0+0x28/0x50
? save_trace+0x54/0x370
? __pfx_dfs_mount_share+0x10/0x10 [cifs]
? __lock_acquire+0xb82/0x2ba0
? __kasan_check_write+0x18/0x20
cifs_mount+0xbc/0x9e0 [cifs]
? __pfx_cifs_mount+0x10/0x10 [cifs]
? do_raw_spin_unlock+0x5d/0x200
? cifs_setup_cifs_sb+0x29d/0x810 [cifs]
cifs_smb3_do_mount+0x263/0x1990 [cifs]
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
08 Jan 2026, 17:31
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Linux
Debian Debian debian Linux Linux linux Kernel |
|
| CWE | CWE-125 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.1 |
| References | () https://git.kernel.org/stable/c/7d34ec36abb84fdfb6632a0f2cbda90379ae21fc - Patch | |
| References | () https://git.kernel.org/stable/c/8de33d4d72e8fae3502ec3850bd7b14e7c7328b6 - Patch | |
| References | () https://git.kernel.org/stable/c/9bdb8e98a0073c73ab3e6c631ec78877ceb64565 - Patch | |
| References | () https://git.kernel.org/stable/c/a0620e1525663edd8c4594f49fb75fe5be4724b0 - Patch | |
| References | () https://git.kernel.org/stable/c/a542f93a123555d09c3ce8bc947f7b56ad8e6463 - Patch | |
| References | () https://git.kernel.org/stable/c/f6eda5b0e8f8123564c5b34f5801d63243032eac - Patch | |
| References | () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory, Mailing List | |
| CPE | cpe:2.3:o:linux:linux_kernel:4.18:rc6:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:4.18:rc7:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:4.18:rc8:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:4.18:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:4.18:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:4.18:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:4.18:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:4.18:rc5:*:*:*:*:*:* |
03 Nov 2025, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
04 Sep 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-04 16:15
Updated : 2026-01-08 17:31
NVD link : CVE-2025-38728
Mitre link : CVE-2025-38728
CVE.ORG link : CVE-2025-38728
JSON object : View
Products Affected
debian
- debian_linux
linux
- linux_kernel
CWE
CWE-125
Out-of-bounds Read