Critical 9.1Published Sep 4, 2025

CVE-2025-38728smb3: fix for slab out of bounds on mount to ksmbd

Updated under an hour ago (2026-10-19 07:10 UTC)

Does this affect you?

It affects Linux and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: smb3: fix for slab out of bounds on mount to ksmbd With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see below): BUG: KASAN: slab-out-of-bounds in parse_server_interfaces+0x14ee/0x1880 [cifs] Read of size 4 at addr ffff8881433dba98 by task mount/9827 CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. Precision Tower 3620/0MWYPT, BIOS 2.13.1 06/14/2019 Call Trace: <TASK> dump_stack_lvl+0x9f/0xf0 print_report+0xd1/0x670 __virt_addr_valid+0x22c/0x430 ? parse_server_interfaces+0x14ee/0x1880 [cifs] ? kasan_complete_mode_report_info+0x2a/0x1f0 ? parse_server_interfaces+0x14ee/0x1880 [cifs] kasan_report+0xd6/0x110 parse_server_interfaces+0x14ee/0x1880 [cifs] __asan_report_load_n_noabort+0x13/0x20 parse_server_interfaces+0x14ee/0x1880 [cifs] ? __pfx_parse_server_interfaces+0x10/0x10 [cifs] ? trace_hardirqs_on+0x51/0x60 SMB3_request_interfaces+0x1ad/0x3f0 [cifs] ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs] ? SMB2_tcon+0x23c/0x15d0 [cifs] smb3_qfs_tcon+0x173/0x2b0 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] ? cifs_get_tcon+0x105d/0x2120 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_get_tcon+0x105d/0x2120 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] cifs_mount_get_tcon+0x369/0xb90 [cifs] ? dfs_cache_find+0xe7/0x150 [cifs] dfs_mount_share+0x985/0x2970 [cifs] ? check_path.constprop.0+0x28/0x50 ? save_trace+0x54/0x370 ? __pfx_dfs_mount_share+0x10/0x10 [cifs] ? __lock_acquire+0xb82/0x2ba0 ? __kasan_check_write+0x18/0x20 cifs_mount+0xbc/0x9e0 [cifs] ? __pfx_cifs_mount+0x10/0x10 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_setup_cifs_sb+0x29d/0x810 [cifs] cifs_smb3_do_mount+0x263/0x1990 [cifs]

CVSS: 9.1 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from fe856be475f7cf5ffcde57341d175ce9fd09434b before 9bdb8e98a0073c73ab3e6c631ec78877ceb64565; from fe856be475f7cf5ffcde57341d175ce9fd09434b before a0620e1525663edd8c4594f49fb75fe5be4724b0; from fe856be475f7cf5ffcde57341d175ce9fd09434b before 8de33d4d72e8fae3502ec3850bd7b14e7c7328b6; from fe856be475f7cf5ffcde57341d175ce9fd09434b before a542f93a123555d09c3ce8bc947f7b56ad8e6463; from fe856be475f7cf5ffcde57341d175ce9fd09434b before f6eda5b0e8f8123564c5b34f5801d63243032eac; from fe856be475f7cf5ffcde57341d175ce9fd09434b before 7d34ec36abb84fdfb6632a0f2cbda90379ae21fc	CNA record
Siemens SIMATIC CN 4100 siemens:simatic_cn_4100 (from the name)	before V5.0	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.18.1 before 6.1.149; from 6.2 before 6.6.103; from 6.7 before 6.12.43; from 6.13 before 6.15.11; from 6.16 before 6.16.2; 4.18; 4.18; 4.18; and 6 more ranges	NVD
debian debian_linux debian:debian_linux	11.0	NVD

References

https://git.kernel.org/stable/c/9bdb8e98a0073c73ab3e6c631ec78877ceb64565patch
https://git.kernel.org/stable/c/a0620e1525663edd8c4594f49fb75fe5be4724b0patch
https://git.kernel.org/stable/c/8de33d4d72e8fae3502ec3850bd7b14e7c7328b6patch
https://git.kernel.org/stable/c/a542f93a123555d09c3ce8bc947f7b56ad8e6463patch
https://git.kernel.org/stable/c/f6eda5b0e8f8123564c5b34f5801d63243032eacpatch
https://git.kernel.org/stable/c/7d34ec36abb84fdfb6632a0f2cbda90379ae21fcpatch
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlmailing-list, third-party-advisory
https://cert-portal.siemens.com/productcert/html/ssa-032379.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.