CyberSecBulletin
CVE-2025-38728NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2025-38728 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 248c1142f09478d6cb8151510cbf4ac2673c8ac5, 9bdb8e98a0073c73ab3e6c631ec78877ceb64565, a0620e1525663edd8c4594f49fb75fe5be4724b0 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.36% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 248c1142f09478d6cb8151510cbf4ac2673c8ac5 or 9bdb8e98a0073c73ab3e6c631ec78877ceb64565 or a0620e1525663edd8c4594f49fb75fe5be4724b0 or 8de33d4d72e8fae3502ec3850bd7b14e7c7328b6, whichever matches your release line, or a later version.
  2. Update SIMATIC CN 4100 to V5.0 or a later version.
  3. Update Linux Kernel to 6.1.149 or 6.6.103 or 6.12.43 or 6.15.11, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxfe856be475f7cf5ffcde57341d175ce9fd09434b up to, but not including, 248c1142f09478d6cb8151510cbf4ac2673c8ac5; fe856be475f7cf5ffcde57341d175ce9fd09434b up to, but not including, 9bdb8e98a0073c73ab3e6c631ec78877ceb64565; fe856be475f7cf5ffcde57341d175ce9fd09434b up to, but not including, a0620e1525663edd8c4594f49fb75fe5be4724b0; fe856be475f7cf5ffcde57341d175ce9fd09434b up to, but not including, 8de33d4d72e8fae3502ec3850bd7b14e7c7328b6; fe856be475f7cf5ffcde57341d175ce9fd09434b up to, but not including, a542f93a123555d09c3ce8bc947f7b56ad8e6463; fe856be475f7cf5ffcde57341d175ce9fd09434b up to, but not including, f6eda5b0e8f8123564c5b34f5801d63243032eac; fe856be475f7cf5ffcde57341d175ce9fd09434b up to, but not including, 7d34ec36abb84fdfb6632a0f2cbda90379ae21fc; 4.18248c1142f09478d6cb8151510cbf4ac2673c8ac5, 9bdb8e98a0073c73ab3e6c631ec78877ceb64565, a0620e1525663edd8c4594f49fb75fe5be4724b0, 8de33d4d72e8fae3502ec3850bd7b14e7c7328b6, a542f93a123555d09c3ce8bc947f7b56ad8e6463, f6eda5b0e8f8123564c5b34f5801d63243032eac
SiemensSIMATIC CN 4100before V5.0V5.0
LinuxLinux Kernel4.18.1 up to, but not including, 6.1.149; 6.2 up to, but not including, 6.6.103; 6.7 up to, but not including, 6.12.43; 6.13 up to, but not including, 6.15.11; 6.16 up to, but not including, 6.16.2; 4.18; 6.176.1.149, 6.6.103, 6.12.43, 6.15.11, 6.16.2
DebianDebian Linux11.0Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.19.1CriticalCNA
CVSS 3.17.1HighNVD

Official description

In the Linux kernel, the following vulnerability has been resolved: smb3: fix for slab out of bounds on mount to ksmbd With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see below): BUG: KASAN: slab-out-of-bounds in parse_server_interfaces+0x14ee/0x1880 [cifs] Read of size 4 at addr ffff8881433dba98 by task mount/9827 CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. Precision Tower 3620/0MWYPT, BIOS 2.13.1 06/14/2019 Call Trace: <TASK> dump_stack_lvl+0x9f/0xf0 print_report+0xd1/0x670 __virt_addr_valid+0x22c/0x430 ? parse_server_interfaces+0x14ee/0x1880 [cifs] ? kasan_complete_mode_report_info+0x2a/0x1f0 ? parse_server_interfaces+0x14ee/0x1880 [cifs] kasan_report+0xd6/0x110 parse_server_interfaces+0x14ee/0x1880 [cifs] __asan_report_load_n_noabort+0x13/0x20 parse_server_interfaces+0x14ee/0x1880 [cifs] ? __pfx_parse_server_interfaces+0x10/0x10 [cifs] ? trace_hardirqs_on+0x51/0x60 SMB3_request_interfaces+0x1ad/0x3f0 [cifs] ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs] ? SMB2_tcon+0x23c/0x15d0 [cifs] smb3_qfs_tcon+0x173/0x2b0 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] ? cifs_get_tcon+0x105d/0x2120 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_get_tcon+0x105d/0x2120 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] cifs_mount_get_tcon+0x369/0xb90 [cifs] ? dfs_cache_find+0xe7/0x150 [cifs] dfs_mount_share+0x985/0x2970 [cifs] ? check_path.constprop.0+0x28/0x50 ? save_trace+0x54/0x370 ? __pfx_dfs_mount_share+0x10/0x10 [cifs] ? __lock_acquire+0xb82/0x2ba0 ? __kasan_check_write+0x18/0x20 cifs_mount+0xbc/0x9e0 [cifs] ? __pfx_cifs_mount+0x10/0x10 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_setup_cifs_sb+0x29d/0x810 [cifs] cifs_smb3_do_mount+0x263/0x1990 [cifs]

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.