{"id":69501,"date":"2025-09-04T21:32:09","date_gmt":"2025-09-04T18:02:09","guid":{"rendered":"https:\/\/afaghhosting.net\/blog\/cve-2025-38728-smb3-fix-for-slab-out-of-bounds-on-mount-to-ksmbd\/"},"modified":"2025-09-04T21:32:09","modified_gmt":"2025-09-04T18:02:09","slug":"cve-2025-38728-smb3-fix-for-slab-out-of-bounds-on-mount-to-ksmbd","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/cve-2025-38728-smb3-fix-for-slab-out-of-bounds-on-mount-to-ksmbd\/","title":{"rendered":"CVE-2025-38728 &#8211; smb3: fix for slab out of bounds on mount to ksmbd"},"content":{"rendered":"<p><strong>CVE ID : <\/strong>CVE-2025-38728<br \/>\n<br \/>\n<strong>Published : <\/strong> Sept. 4, 2025, 4:15 p.m. | 56\u00a0minutes ago<br \/>\n<br \/>\n<strong>Description : <\/strong>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>smb3: fix for slab out of bounds on mount to ksmbd<\/p>\n<p>With KASAN enabled, it is possible to get a slab out of bounds<br \/>\nduring mount to ksmbd due to missing check in parse_server_interfaces()<br \/>\n(see below):<\/p>\n<p> BUG: KASAN: slab-out-of-bounds in<br \/>\n parse_server_interfaces+0x14ee\/0x1880 [cifs]\n Read of size 4 at addr ffff8881433dba98 by task mount\/9827<\/p>\n<p> CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G<br \/>\n OE       6.16.0-rc2-kasan #2 PREEMPT(voluntary)<br \/>\n Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE<br \/>\n Hardware name: Dell Inc. Precision Tower 3620\/0MWYPT,<br \/>\n BIOS 2.13.1 06\/14\/2019<br \/>\n Call Trace:<\/p>\n<p> dump_stack_lvl+0x9f\/0xf0<br \/>\n print_report+0xd1\/0x670<br \/>\n __virt_addr_valid+0x22c\/0x430<br \/>\n ? parse_server_interfaces+0x14ee\/0x1880 [cifs]\n ? kasan_complete_mode_report_info+0x2a\/0x1f0<br \/>\n ? parse_server_interfaces+0x14ee\/0x1880 [cifs]\n   kasan_report+0xd6\/0x110<br \/>\n   parse_server_interfaces+0x14ee\/0x1880 [cifs]\n   __asan_report_load_n_noabort+0x13\/0x20<br \/>\n   parse_server_interfaces+0x14ee\/0x1880 [cifs]\n ? __pfx_parse_server_interfaces+0x10\/0x10 [cifs]\n ? trace_hardirqs_on+0x51\/0x60<br \/>\n SMB3_request_interfaces+0x1ad\/0x3f0 [cifs]\n ? __pfx_SMB3_request_interfaces+0x10\/0x10 [cifs]\n ? SMB2_tcon+0x23c\/0x15d0 [cifs]\n smb3_qfs_tcon+0x173\/0x2b0 [cifs]\n ? __pfx_smb3_qfs_tcon+0x10\/0x10 [cifs]\n ? cifs_get_tcon+0x105d\/0x2120 [cifs]\n ? do_raw_spin_unlock+0x5d\/0x200<br \/>\n ? cifs_get_tcon+0x105d\/0x2120 [cifs]\n ? __pfx_smb3_qfs_tcon+0x10\/0x10 [cifs]\n cifs_mount_get_tcon+0x369\/0xb90 [cifs]\n ? dfs_cache_find+0xe7\/0x150 [cifs]\n dfs_mount_share+0x985\/0x2970 [cifs]\n ? check_path.constprop.0+0x28\/0x50<br \/>\n ? save_trace+0x54\/0x370<br \/>\n ? __pfx_dfs_mount_share+0x10\/0x10 [cifs]\n ? __lock_acquire+0xb82\/0x2ba0<br \/>\n ? __kasan_check_write+0x18\/0x20<br \/>\n cifs_mount+0xbc\/0x9e0 [cifs]\n ? __pfx_cifs_mount+0x10\/0x10 [cifs]\n ? do_raw_spin_unlock+0x5d\/0x200<br \/>\n ? cifs_setup_cifs_sb+0x29d\/0x810 [cifs]\n cifs_smb3_do_mount+0x263\/0x1990 [cifs]\n<br \/>\n<strong>Severity:<\/strong> 0.0 | NA<br \/>\n<br \/>\nVisit the link for more details, such as CVSS details, affected products, timeline, and more&#8230;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CVE ID : CVE-2025-38728 Published : Sept. 4, 2025, 4:15 p.m. | 56\u00a0minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: smb3: fix for slab out of bounds on mount to ksmbd With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-69501","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/69501","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=69501"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/69501\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=69501"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=69501"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=69501"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}