---
id: CVE-2025-38728
title: 'smb3: fix for slab out of bounds on mount to ksmbd'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb3: fix for slab out of bounds on mount to ksmbd

  With KASAN enabled, it is possible to get a slab out of bounds
  during mount to ksmbd due to missing check in parse_s…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b <
    9bdb8e98a0073c73ab3e6c631ec78877ceb64565
  - >-
    Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b <
    a0620e1525663edd8c4594f49fb75fe5be4724b0
  - >-
    Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b <
    8de33d4d72e8fae3502ec3850bd7b14e7c7328b6
  - >-
    Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b <
    a542f93a123555d09c3ce8bc947f7b56ad8e6463
  - >-
    Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b <
    f6eda5b0e8f8123564c5b34f5801d63243032eac
  - >-
    Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b <
    7d34ec36abb84fdfb6632a0f2cbda90379ae21fc
  - Linux 4.18
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-15T21:52:54.702361Z'
published: '2025-09-04'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:02:28.386Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38728'
references:
  - url: 'https://git.kernel.org/stable/c/9bdb8e98a0073c73ab3e6c631ec78877ceb64565'
  - url: 'https://git.kernel.org/stable/c/a0620e1525663edd8c4594f49fb75fe5be4724b0'
  - url: 'https://git.kernel.org/stable/c/8de33d4d72e8fae3502ec3850bd7b14e7c7328b6'
  - url: 'https://git.kernel.org/stable/c/a542f93a123555d09c3ce8bc947f7b56ad8e6463'
  - url: 'https://git.kernel.org/stable/c/f6eda5b0e8f8123564c5b34f5801d63243032eac'
  - url: 'https://git.kernel.org/stable/c/7d34ec36abb84fdfb6632a0f2cbda90379ae21fc'
tags:
  - cve.org
epss: 0.00322
epssPercentile: 0.25035
ingestedAt: '2026-10-15T22:48:25.518Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb3: fix for slab out of bounds on mount to ksmbd

With KASAN enabled, it is possible to get a slab out of bounds
during mount to ksmbd due to missing check in parse_server_interfaces()
(see below):

 BUG: KASAN: slab-out-of-bounds in
 parse_server_interfaces+0x14ee/0x1880 [cifs]
 Read of size 4 at addr ffff8881433dba98 by task mount/9827

 CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G
 OE       6.16.0-rc2-kasan #2 PREEMPT(voluntary)
 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
 Hardware name: Dell Inc. Precision Tower 3620/0MWYPT,
 BIOS 2.13.1 06/14/2019
 Call Trace:
  <TASK>
 dump_stack_lvl+0x9f/0xf0
 print_report+0xd1/0x670
 __virt_addr_valid+0x22c/0x430
 ? parse_server_interfaces+0x14ee/0x1880 [cifs]
 ? kasan_complete_mode_report_info+0x2a/0x1f0
 ? parse_server_interfaces+0x14ee/0x1880 [cifs]
   kasan_report+0xd6/0x110
   parse_server_interfaces+0x14ee/0x1880 [cifs]
   __asan_report_load_n_noabort+0x13/0x20
   parse_server_interfaces+0x14ee/0x1880 [cifs]
 ? __pfx_parse_server_interfaces+0x10/0x10 [cifs]
 ? trace_hardirqs_on+0x51/0x60
 SMB3_request_interfaces+0x1ad/0x3f0 [cifs]
 ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs]
 ? SMB2_tcon+0x23c/0x15d0 [cifs]
 smb3_qfs_tcon+0x173/0x2b0 [cifs]
 ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs]
 ? cifs_get_tcon+0x105d/0x2120 [cifs]
 ? do_raw_spin_unlock+0x5d/0x200
 ? cifs_get_tcon+0x105d/0x2120 [cifs]
 ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs]
 cifs_mount_get_tcon+0x369/0xb90 [cifs]
 ? dfs_cache_find+0xe7/0x150 [cifs]
 dfs_mount_share+0x985/0x2970 [cifs]
 ? check_path.constprop.0+0x28/0x50
 ? save_trace+0x54/0x370
 ? __pfx_dfs_mount_share+0x10/0x10 [cifs]
 ? __lock_acquire+0xb82/0x2ba0
 ? __kasan_check_write+0x18/0x20
 cifs_mount+0xbc/0x9e0 [cifs]
 ? __pfx_cifs_mount+0x10/0x10 [cifs]
 ? do_raw_spin_unlock+0x5d/0x200
 ? cifs_setup_cifs_sb+0x29d/0x810 [cifs]
 cifs_smb3_do_mount+0x263/0x1990 [cifs]

## Affected

- `Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b < 9bdb8e98a0073c73ab3e6c631ec78877ceb64565`
- `Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b < a0620e1525663edd8c4594f49fb75fe5be4724b0`
- `Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b < 8de33d4d72e8fae3502ec3850bd7b14e7c7328b6`
- `Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b < a542f93a123555d09c3ce8bc947f7b56ad8e6463`
- `Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b < f6eda5b0e8f8123564c5b34f5801d63243032eac`
- `Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b < 7d34ec36abb84fdfb6632a0f2cbda90379ae21fc`
- `Linux 4.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.