CVE-2025-38728

Vulnerability

Description

CVE-2025-38728 is a memory safety vulnerability in the Linux kernel's CIFS/SMB3 client implementation. The bug resides in the parse_server_interfaces() function, which is invoked early during the mount process to a ksmbd server. A missing bounds check on incoming network data allows an attacker-controlled server to trigger a slab-out-of-bounds read of 4 bytes, as confirmed by KASAN reports [description].

Exploitation

The attack surface is the mount operation itself. To exploit this, a remote attacker would need to operate a ksmbd (Samba kernel SMB server) instance that the victim's system connects to. No elevated privileges are required beyond the ability to serve SMB3 share information; the vulnerable code path is reached during the normal client-side mount sequence (cifs_mount_get_tcon > smb3_qfs_tcon > SMB3_request_interfaces > parse_server_interfaces) [description]. The server sends specially crafted interface data that lacks proper length validation, causing the client to read beyond allocated slab memory [description].

Impact

A successful exploit results in a kernel slab-out-of-bounds read, which can leak sensitive kernel memory or, in some configurations, lead to a system crash (denial of service). The KASAN report shows a read of size 4, indicating that an attacker may obtain small amounts of information from adjacent kernel objects [description]. The vulnerability is rated High with a CVSS v3 score of 7.1, reflecting the potential for confidentiality and availability impacts without requiring authentication from the attacker's perspective (the server controls the data).

Mitigation

The Linux kernel community has addressed this bug through a series of stable kernel commits [2][3][4]. Users should apply the latest kernel updates from their distributor. The fix introduces the missing bounds check in parse_server_interfaces() to ensure that the server-provided interface data does not exceed allocated buffers [description]. Affected products include Siemens SIMATIC CN 4100 devices (all versions < V5.0), which list this CVE among those remediated in a future version [1].