CVE-2025-38728

smb3: fix for slab out of bounds on mount to ksmbd

State: Published
Severity: 9.1 Critical
Published: Sep 4, 2025
Updated: Oct 30, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

smb3: fix for slab out of bounds on mount to ksmbd

With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see below):

BUG: KASAN: slab-out-of-bounds in parse_server_interfaces+0x14ee/0x1880 [cifs] Read of size 4 at addr ffff8881433dba98 by task mount/9827

CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. Precision Tower 3620/0MWYPT, BIOS 2.13.1 06/14/2019 Call Trace: <TASK> dump_stack_lvl+0x9f/0xf0 print_report+0xd1/0x670 __virt_addr_valid+0x22c/0x430 ? parse_server_interfaces+0x14ee/0x1880 [cifs] ? kasan_complete_mode_report_info+0x2a/0x1f0 ? parse_server_interfaces+0x14ee/0x1880 [cifs] kasan_report+0xd6/0x110 parse_server_interfaces+0x14ee/0x1880 [cifs] __asan_report_load_n_noabort+0x13/0x20 parse_server_interfaces+0x14ee/0x1880 [cifs] ? __pfx_parse_server_interfaces+0x10/0x10 [cifs] ? trace_hardirqs_on+0x51/0x60 SMB3_request_interfaces+0x1ad/0x3f0 [cifs] ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs] ? SMB2_tcon+0x23c/0x15d0 [cifs] smb3_qfs_tcon+0x173/0x2b0 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] ? cifs_get_tcon+0x105d/0x2120 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_get_tcon+0x105d/0x2120 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] cifs_mount_get_tcon+0x369/0xb90 [cifs] ? dfs_cache_find+0xe7/0x150 [cifs] dfs_mount_share+0x985/0x2970 [cifs] ? check_path.constprop.0+0x28/0x50 ? save_trace+0x54/0x370 ? __pfx_dfs_mount_share+0x10/0x10 [cifs] ? __lock_acquire+0xb82/0x2ba0 ? __kasan_check_write+0x18/0x20 cifs_mount+0xbc/0x9e0 [cifs] ? __pfx_cifs_mount+0x10/0x10 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_setup_cifs_sb+0x29d/0x810 [cifs] cifs_smb3_do_mount+0x263/0x1990 [cifs]

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	fe856be475f7cf5ffcde57341d175ce9fd09434b to before 248c1142f09478d6cb8151510cbf4ac2673c8ac5Affected fe856be475f7cf5ffcde57341d175ce9fd09434b to before 9bdb8e98a0073c73ab3e6c631ec78877ceb64565Affected fe856be475f7cf5ffcde57341d175ce9fd09434b to before a0620e1525663edd8c4594f49fb75fe5be4724b0Affected fe856be475f7cf5ffcde57341d175ce9fd09434b to before 8de33d4d72e8fae3502ec3850bd7b14e7c7328b6Affected fe856be475f7cf5ffcde57341d175ce9fd09434b to before a542f93a123555d09c3ce8bc947f7b56ad8e6463Affected fe856be475f7cf5ffcde57341d175ce9fd09434b to before f6eda5b0e8f8123564c5b34f5801d63243032eacAffected fe856be475f7cf5ffcde57341d175ce9fd09434b to before 7d34ec36abb84fdfb6632a0f2cbda90379ae21fcAffected
LinuxLinux	4.18Affected before 4.18Not affected 5.15.224 through 5.15.Not affected 6.1.149 through 6.1.Not affected 6.6.103 through 6.6.Not affected 6.12.43 through 6.12.Not affected 6.15.11 through 6.15.Not affected 6.16.2 through 6.16.Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

fe856be475f7cf5ffcde57341d175ce9fd09434b to before 248c1142f09478d6cb8151510cbf4ac2673c8ac5Affected
fe856be475f7cf5ffcde57341d175ce9fd09434b to before 9bdb8e98a0073c73ab3e6c631ec78877ceb64565Affected
fe856be475f7cf5ffcde57341d175ce9fd09434b to before a0620e1525663edd8c4594f49fb75fe5be4724b0Affected
fe856be475f7cf5ffcde57341d175ce9fd09434b to before 8de33d4d72e8fae3502ec3850bd7b14e7c7328b6Affected
fe856be475f7cf5ffcde57341d175ce9fd09434b to before a542f93a123555d09c3ce8bc947f7b56ad8e6463Affected
fe856be475f7cf5ffcde57341d175ce9fd09434b to before f6eda5b0e8f8123564c5b34f5801d63243032eacAffected
fe856be475f7cf5ffcde57341d175ce9fd09434b to before 7d34ec36abb84fdfb6632a0f2cbda90379ae21fcAffected

LinuxLinux

4.18Affected
before 4.18Not affected
5.15.224 through 5.15.*Not affected
6.1.149 through 6.1.*Not affected
6.6.103 through 6.6.*Not affected
6.12.43 through 6.12.*Not affected
6.15.11 through 6.15.*Not affected
6.16.2 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.