CVE-2025-38728

What it actually does

Missing bounds check in parse_server_interfaces allows slab out-of-bounds read when processing server interface responses during SMB3 mount to a ksmbd server.

Why it matters to the business

Local users on affected Linux systems can trigger kernel memory corruption leading to crashes or information disclosure when mounting shares from malicious or compromised ksmbd servers, disrupting file access and requiring system reboots.

How an attack unfolds

An attacker hosts a ksmbd server that returns crafted interface data exceeding expected lengths. When a victim runs mount against that server, SMB3_request_interfaces calls parse_server_interfaces which performs an unchecked read, resulting in KASAN-detected slab out-of-bounds access.

How to fix it

Update the Linux kernel to a version containing commit 9bdb8e98a0073c73ab3e6c631ec78877ceb64565 or later stable releases that include the bounds check in parse_server_interfaces. Rebuild and reboot after applying the fix.

How to confirm the fix worked

Confirm the fix is present by verifying the kernel source contains the corrected parse_server_interfaces function and test mounting against a ksmbd instance that previously triggered the out-of-bounds condition; monitor for absence of KASAN reports.

Typical attack path

1. Attacker configures ksmbd to reply with oversized server interface structures
2. Victim executes mount command targeting the attacker's share
3. cifs_mount path reaches SMB3_request_interfaces and parse_server_interfaces
4. Out-of-bounds read occurs on the returned interface buffer
5. Kernel reports slab corruption or panics depending on memory layout

How to detect it

Review kernel logs for KASAN slab-out-of-bounds reports referencing parse_server_interfaces and cifs during mount operations; correlate with SMB3 mount attempts to external servers.

What your security team should do

• Apply the referenced kernel commit or newer distribution packages immediately on all systems using the cifs module
• Restrict untrusted SMB mounts until patches are deployed
• Enable kernel hardening features such as KASAN in test environments to detect similar issues early