CVE-2025-38728 Overview
CVE-2025-38728 is an out-of-bounds read vulnerability in the Linux kernel's cifs (SMB3) client. The flaw exists in the parse_server_interfaces() function, which lacks proper bounds checking when parsing server interface data returned during a mount to a ksmbd server. When Kernel Address Sanitizer (KASAN) is enabled, the condition produces a slab-out-of-bounds read reported by the cifs module. The vulnerability affects Linux kernel versions including branches back to 4.18 and up to 6.17-rc1, as well as Debian Linux 11.0. Kernel maintainers merged fixes across multiple stable branches.
Critical Impact
A local user mounting a crafted or malicious ksmbd share can trigger an out-of-bounds read in kernel memory, potentially causing kernel memory disclosure or a denial-of-service condition.
Affected Products
- Linux Kernel (multiple branches, including 4.18 and 6.17-rc1)
- Debian Linux 11.0
- Downstream distributions and Siemens products embedding affected kernels
Discovery Timeline
- 2025-09-04 - CVE-2025-38728 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-38728
Vulnerability Analysis
The vulnerability resides in parse_server_interfaces() within the cifs kernel module. The function processes the list of network interfaces returned by an SMB3 server during mount negotiation. Missing validation of the buffer length against the declared interface entry size allows the parser to read beyond the allocated slab object. KASAN captures this as a slab-out-of-bounds read of 4 bytes during the SMB3_request_interfaces code path, invoked from smb3_qfs_tcon and cifs_mount_get_tcon.
The issue is classified as [CWE-125] Out-of-Bounds Read. Exploitation requires local privileges to initiate a mount operation, and the target must be a ksmbd server that returns malformed interface data. Successful triggering can leak adjacent kernel heap contents or destabilize the kernel, resulting in loss of availability.
Root Cause
The root cause is a missing length check in parse_server_interfaces(). The function assumes that the server-supplied interface list contains at least as many bytes as the fixed-size interface entries it iterates over. When the returned buffer is shorter than expected, the parser dereferences memory past the end of the allocation.
Attack Vector
The attack requires an authenticated local user with mount privileges and a reachable ksmbd server under adversary influence. When the client issues an SMB3 FSCTL_QUERY_NETWORK_INTERFACE_INFO request, the malicious server returns a truncated or malformed response. The cifs client parses this response without validating length, causing the out-of-bounds read. The condition can be reached automatically during any mount to the attacker-controlled server.
No verified public proof-of-concept is available. The vulnerability is described in prose based on the upstream kernel commit messages and KASAN report referenced in the NVD entry.
Detection Methods for CVE-2025-38728
Indicators of Compromise
- KASAN reports referencing slab-out-of-bounds in parse_server_interfaces in kernel logs.
- Kernel oops or panic traces including SMB3_request_interfaces, smb3_qfs_tcon, or cifs_mount_get_tcon frames.
- Unexpected client mounts to untrusted ksmbd servers on non-standard networks.
Detection Strategies
- Monitor dmesg and journal logs for cifs module warnings, KASAN reports, and mount failures involving SMB3.
- Audit kernel version inventories and correlate against the fixed commits listed by kernel.org.
- Track outbound SMB (TCP 445) sessions from Linux hosts to unmanaged or external endpoints.
Monitoring Recommendations
- Ingest kernel logs into a centralized SIEM and alert on parse_server_interfaces or KASAN slab-out-of-bounds messages.
- Correlate mount syscalls with destination IPs to identify connections to unauthorized SMB servers.
- Track package inventory for kernel and linux-image updates across Debian and derivative distributions.
How to Mitigate CVE-2025-38728
Immediate Actions Required
- Apply the kernel updates published in the Debian LTS Announcement and the corresponding Siemens Product Security Advisory where applicable.
- Update to a Linux kernel that includes the fixes referenced by upstream commits such as 7d34ec36abb8 and a542f93a1235.
- Restrict which users can mount SMB shares and validate the trust level of target SMB servers.
Patch Information
Upstream fixes are available in stable kernel branches through six commits published on kernel.org, including 7d34ec36abb8, 8de33d4d72e8, 9bdb8e98a007, a0620e152566, a542f93a1235, and f6eda5b0e8f8. Debian users should install the kernel update referenced in the Debian LTS announcement.
Workarounds
- Avoid mounting SMB3 shares from untrusted or unmanaged ksmbd servers until the kernel is patched.
- Block outbound SMB (TCP 445) traffic from Linux clients to networks outside administrative control.
- Remove or restrict the cifs kernel module on hosts that do not require SMB client functionality using modprobe blacklists.
# Blacklist the cifs module on systems that do not need SMB client support
echo "blacklist cifs" | sudo tee /etc/modprobe.d/blacklist-cifs.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
