{"id":"DEBIAN-CVE-2025-38728","details":"In the Linux kernel, the following vulnerability has been resolved:  smb3: fix for slab out of bounds on mount to ksmbd  With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see below):   BUG: KASAN: slab-out-of-bounds in  parse_server_interfaces+0x14ee/0x1880 [cifs]  Read of size 4 at addr ffff8881433dba98 by task mount/9827   CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G  OE       6.16.0-rc2-kasan #2 PREEMPT(voluntary)  Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE  Hardware name: Dell Inc. Precision Tower 3620/0MWYPT,  BIOS 2.13.1 06/14/2019  Call Trace:   \u003cTASK\u003e  dump_stack_lvl+0x9f/0xf0  print_report+0xd1/0x670  __virt_addr_valid+0x22c/0x430  ? parse_server_interfaces+0x14ee/0x1880 [cifs]  ? kasan_complete_mode_report_info+0x2a/0x1f0  ? parse_server_interfaces+0x14ee/0x1880 [cifs]    kasan_report+0xd6/0x110    parse_server_interfaces+0x14ee/0x1880 [cifs]    __asan_report_load_n_noabort+0x13/0x20    parse_server_interfaces+0x14ee/0x1880 [cifs]  ? __pfx_parse_server_interfaces+0x10/0x10 [cifs]  ? trace_hardirqs_on+0x51/0x60  SMB3_request_interfaces+0x1ad/0x3f0 [cifs]  ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs]  ? SMB2_tcon+0x23c/0x15d0 [cifs]  smb3_qfs_tcon+0x173/0x2b0 [cifs]  ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs]  ? cifs_get_tcon+0x105d/0x2120 [cifs]  ? do_raw_spin_unlock+0x5d/0x200  ? cifs_get_tcon+0x105d/0x2120 [cifs]  ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs]  cifs_mount_get_tcon+0x369/0xb90 [cifs]  ? dfs_cache_find+0xe7/0x150 [cifs]  dfs_mount_share+0x985/0x2970 [cifs]  ? check_path.constprop.0+0x28/0x50  ? save_trace+0x54/0x370  ? __pfx_dfs_mount_share+0x10/0x10 [cifs]  ? __lock_acquire+0xb82/0x2ba0  ? __kasan_check_write+0x18/0x20  cifs_mount+0xbc/0x9e0 [cifs]  ? __pfx_cifs_mount+0x10/0x10 [cifs]  ? do_raw_spin_unlock+0x5d/0x200  ? cifs_setup_cifs_sb+0x29d/0x810 [cifs]  cifs_smb3_do_mount+0x263/0x1990 [cifs]","modified":"2026-09-01T16:06:15.400676265Z","published":"2025-09-04T16:15:42.867Z","upstream":["CVE-2025-38728"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-38728"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.153-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.147-1","6.1.148-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38728.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.43-1"}]}],"versions":["6.12.38-1","6.12.41-1","6.12.43-1~bpo12+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38728.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16.3-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.107-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.3-1~bpo13+1","6.16~rc7-1~exp1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38728.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}]}