smb3: fix for slab out of bounds on mount to ksmbd
Affects the Linux kernel cifs/smb3 client when mounting a share from a ksmbd server on KASAN-enabled builds. Fixed in kernel 6.1.149, 6.6.103, 6.12.43, 6.15.11, and 6.16.2.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 6.1.149, 6.6.103, 6.12.43, 6.15.11, 6.16.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
The Linux kernel's CIFS/SMB3 client, specifically its mount path that requests server network interface information from ksmbd (the in-kernel SMB server), can perform an out-of-bounds memory read during parsing. This flaw could cause a kernel memory access error, potentially leading to a crash or instability when mounting such shares.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In the Linux kernel, the following vulnerability has been resolved: smb3: fix for slab out of bounds on mount to ksmbd With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see below): BUG: KASAN: slab-out-of-bounds in parse_server_interfaces+0x14ee/0x1880 [cifs] Read of size 4 at addr ffff8881433dba98 by task mount/9827 CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. Precision Tower 3620/0MWYPT, BIOS 2.13.1 06/14/2019 Call Trace: <TASK> dump_stack_lvl+0x9f/0xf0 print_report+0xd1/0x670 __virt_addr_valid+0x22c/0x430 ? parse_server_interfaces+0x14ee/0x1880 [cifs] ? kasan_complete_mode_report_info+0x2a/0x1f0 ? parse_server_interfaces+0x14ee/0x1880 [cifs] kasan_report+0xd6/0x110 parse_server_interfaces+0x14ee/0x1880 [cifs] __asan_report_load_n_noabort+0x13/0x20 parse_server_interfaces+0x14ee/0x1880 [cifs] ? __pfx_parse_server_interfaces+0x10/0x10 [cifs] ? trace_hardirqs_on+0x51/0x60 SMB3_request_interfaces+0x1ad/0x3f0 [cifs] ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs] ? SMB2_tcon+0x23c/0x15d0 [cifs] smb3_qfs_tcon+0x173/0x2b0 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] ? cifs_get_tcon+0x105d/0x2120 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_get_tcon+0x105d/0x2120 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] cifs_mount_get_tcon+0x369/0xb90 [cifs] ? dfs_cache_find+0xe7/0x150 [cifs] dfs_mount_share+0x985/0x2970 [cifs] ? check_path.constprop.0+0x28/0x50 ? save_trace+0x54/0x370 ? __pfx_dfs_mount_share+0x10/0x10 [cifs] ? __lock_acquire+0xb82/0x2ba0 ? __kasan_check_write+0x18/0x20 cifs_mount+0xbc/0x9e0 [cifs] ? __pfx_cifs_mount+0x10/0x10 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_setup_cifs_sb+0x29d/0x810 [cifs] cifs_smb3_do_mount+0x263/0x1990 [cifs]
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- Linux Linux
Version range not reported
- Linux Linux
4.18
- KernelLinux
From 4.18.0 · fixed in 6.1.149; From 6.2.0 · fixed in 6.6.103; From 6.7.0 · fixed in 6.12.43; From 6.13.0 · fixed in 6.15.11; From 6.16.0 · fixed in 6.16.2
References 7
git.kernel.org
- stable/c/248c1142f09478d6cb8151510cbf4ac2673c8ac5
- stable/c/9bdb8e98a0073c73ab3e6c631ec78877ceb64565
- stable/c/a0620e1525663edd8c4594f49fb75fe5be4724b0
- stable/c/8de33d4d72e8fae3502ec3850bd7b14e7c7328b6
- stable/c/a542f93a123555d09c3ce8bc947f7b56ad8e6463
- stable/c/f6eda5b0e8f8123564c5b34f5801d63243032eac
- stable/c/7d34ec36abb84fdfb6632a0f2cbda90379ae21fc
Questions about CVE-2025-38728
What does this mean?
A missing check in the cifs/smb3 client's parse_server_interfaces() function lets it read past the end of a slab-allocated buffer while a share is being mounted. KASAN, the kernel's memory error detector, reports this out-of-bounds read.Source: git.kernel.org
Am I affected, and how do I check?
The advisory lists Linux kernel versions from 4.18.0 up to the fixed releases for each branch, including 6.2.0 to 6.6.103, 6.7.0 to 6.12.43, and 6.13.0 to 6.15.11. The bug is reported only with KASAN enabled, so check the running kernel with uname -r and whether CONFIG_KASAN is set in the kernel config.Source: git.kernel.org
What should I do about it?
Upgrade the kernel to the fixed release for its branch: 6.1.149, 6.6.103, 6.12.43, 6.15.11, or 6.16.2.Source: git.kernel.org
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data