{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-38728","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T04:51:24.033Z","datePublished":"2025-09-04T15:33:26.039Z","dateUpdated":"2026-08-05T12:04:19.517Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:04:19.517Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb3: fix for slab out of bounds on mount to ksmbd\n\nWith KASAN enabled, it is possible to get a slab out of bounds\nduring mount to ksmbd due to missing check in parse_server_interfaces()\n(see below):\n\n BUG: KASAN: slab-out-of-bounds in\n parse_server_interfaces+0x14ee/0x1880 [cifs]\n Read of size 4 at addr ffff8881433dba98 by task mount/9827\n\n CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G\n OE       6.16.0-rc2-kasan #2 PREEMPT(voluntary)\n Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n Hardware name: Dell Inc. Precision Tower 3620/0MWYPT,\n BIOS 2.13.1 06/14/2019\n Call Trace:\n  <TASK>\n dump_stack_lvl+0x9f/0xf0\n print_report+0xd1/0x670\n __virt_addr_valid+0x22c/0x430\n ? parse_server_interfaces+0x14ee/0x1880 [cifs]\n ? kasan_complete_mode_report_info+0x2a/0x1f0\n ? parse_server_interfaces+0x14ee/0x1880 [cifs]\n   kasan_report+0xd6/0x110\n   parse_server_interfaces+0x14ee/0x1880 [cifs]\n   __asan_report_load_n_noabort+0x13/0x20\n   parse_server_interfaces+0x14ee/0x1880 [cifs]\n ? __pfx_parse_server_interfaces+0x10/0x10 [cifs]\n ? trace_hardirqs_on+0x51/0x60\n SMB3_request_interfaces+0x1ad/0x3f0 [cifs]\n ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs]\n ? SMB2_tcon+0x23c/0x15d0 [cifs]\n smb3_qfs_tcon+0x173/0x2b0 [cifs]\n ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs]\n ? cifs_get_tcon+0x105d/0x2120 [cifs]\n ? do_raw_spin_unlock+0x5d/0x200\n ? cifs_get_tcon+0x105d/0x2120 [cifs]\n ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs]\n cifs_mount_get_tcon+0x369/0xb90 [cifs]\n ? dfs_cache_find+0xe7/0x150 [cifs]\n dfs_mount_share+0x985/0x2970 [cifs]\n ? check_path.constprop.0+0x28/0x50\n ? save_trace+0x54/0x370\n ? __pfx_dfs_mount_share+0x10/0x10 [cifs]\n ? __lock_acquire+0xb82/0x2ba0\n ? __kasan_check_write+0x18/0x20\n cifs_mount+0xbc/0x9e0 [cifs]\n ? __pfx_cifs_mount+0x10/0x10 [cifs]\n ? do_raw_spin_unlock+0x5d/0x200\n ? cifs_setup_cifs_sb+0x29d/0x810 [cifs]\n cifs_smb3_do_mount+0x263/0x1990 [cifs]"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The out-of-bounds offset is the `Next` field of an SMB2 FSCTL_QUERY_NETWORK_INTERFACE_INFO response received over TCP/445 from a remote SMB server, parsed by the in-kernel cifs client. A malicious or compromised SMB server (or MITM on an unsigned session) triggers it purely with network data.\nAC:L - The server directly controls the 32-bit `Next` value and the response length, so it deterministically drives `p` past the end of the kmemdup'd buffer on the first entry; no race, timing, or memory-layout condition outside the attacker's control is involved.\nPR:N - The attacker is the peer SMB server, which holds no privileges on the victim client — it is the client that authenticates to the server, not the reverse. No credentials or local account on the target are needed.\nUI:N - Besides the mount path, `SMB3_request_interfaces()` is invoked from the `smb2_query_server_interfaces()` delayed work re-queued every 600 s and from `smb2_reconnect()`; since the server itself advertises the MULTI_CHANNEL capability that schedules that poll and can force a reconnect by dropping the connection, it can trigger the parse repeatedly on a pre-existing mount with no victim action.\nS:U - The invalid read and its consequences stay within the kernel of the affected client host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The server chooses an arbitrary offset of up to 4 GiB past the response allocation, giving an unbounded wild read of kernel memory rather than a small bounded overread, consistent with kernel.org CNA treatment of cifs client OOB reads (e.g. CVE-2026-31613, CVE-2026-46155).\nI:N - The defect is strictly a read: `bytes_left` goes negative and the loop exits before any out-of-bounds bytes are copied into `tmp_iface` or the interface list, and there is no out-of-bounds write.\nA:H - Dereferencing a pointer up to 4 GiB beyond a slab object readily hits an unmapped direct-map address, producing a kernel oops that kills the mounting or cifsiod worker context (and a KASAN report/panic on hardened kernels); the server can repeat it on every reconnect."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/smb2ops.c"],"versions":[{"version":"fe856be475f7cf5ffcde57341d175ce9fd09434b","lessThan":"9bdb8e98a0073c73ab3e6c631ec78877ceb64565","status":"affected","versionType":"git"},{"version":"fe856be475f7cf5ffcde57341d175ce9fd09434b","lessThan":"a0620e1525663edd8c4594f49fb75fe5be4724b0","status":"affected","versionType":"git"},{"version":"fe856be475f7cf5ffcde57341d175ce9fd09434b","lessThan":"8de33d4d72e8fae3502ec3850bd7b14e7c7328b6","status":"affected","versionType":"git"},{"version":"fe856be475f7cf5ffcde57341d175ce9fd09434b","lessThan":"a542f93a123555d09c3ce8bc947f7b56ad8e6463","status":"affected","versionType":"git"},{"version":"fe856be475f7cf5ffcde57341d175ce9fd09434b","lessThan":"f6eda5b0e8f8123564c5b34f5801d63243032eac","status":"affected","versionType":"git"},{"version":"fe856be475f7cf5ffcde57341d175ce9fd09434b","lessThan":"7d34ec36abb84fdfb6632a0f2cbda90379ae21fc","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/smb2ops.c"],"versions":[{"version":"4.18","status":"affected"},{"version":"0","lessThan":"4.18","status":"unaffected","versionType":"semver"},{"version":"6.1.149","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.103","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.43","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.15.11","lessThanOrEqual":"6.15.*","status":"unaffected","versionType":"semver"},{"version":"6.16.2","lessThanOrEqual":"6.16.*","status":"unaffected","versionType":"semver"},{"version":"6.17","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"6.1.149"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"6.6.103"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"6.12.43"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"6.15.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"6.16.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"6.17"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/9bdb8e98a0073c73ab3e6c631ec78877ceb64565"},{"url":"https://git.kernel.org/stable/c/a0620e1525663edd8c4594f49fb75fe5be4724b0"},{"url":"https://git.kernel.org/stable/c/8de33d4d72e8fae3502ec3850bd7b14e7c7328b6"},{"url":"https://git.kernel.org/stable/c/a542f93a123555d09c3ce8bc947f7b56ad8e6463"},{"url":"https://git.kernel.org/stable/c/f6eda5b0e8f8123564c5b34f5801d63243032eac"},{"url":"https://git.kernel.org/stable/c/7d34ec36abb84fdfb6632a0f2cbda90379ae21fc"}],"title":"smb3: fix for slab out of bounds on mount to ksmbd","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T17:41:57.246Z"}},{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-05-12T12:05:57.850Z"},"affected":[{"vendor":"Siemens","product":"SIMATIC CN 4100","versions":[{"status":"affected","version":"0","lessThan":"V5.0","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}]}]}}