Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s SMB3 client can read beyond an allocated memory object while mounting a share served by ksmbd. The supplied CVSS 9.1 rating reflects potentially severe confidentiality and availability impact. Practical risk depends on whether a host uses CIFS/SMB3 mounts and runs an affected kernel; the bundle provides no evidence of active exploitation.
Executive priority
Accelerate remediation for Linux systems that mount SMB3 shares. Prioritize business-critical hosts and connections to untrusted or externally managed SMB servers. Deprioritize systems without this functionality only after evidence-based validation. The critical score warrants urgency, while the absence of cited real-world exploitation argues against unsupported emergency claims.
Technical view
parse_server_interfaces() in the cifs module lacks a required bounds check while processing server-interface data during an SMB3 mount to ksmbd. KASAN recorded a four-byte slab out-of-bounds read. The sources identify upstream stable fixes, but the supplied flattened version list is insufficient to classify every downstream build reliably.
Likely exposure
Most likely exposure is on Linux systems using the cifs client to mount SMB3 shares, particularly ksmbd-served shares. Systems that never use cifs or perform SMB3 mounts are less likely exposed to this path. Kernel versions alone may mislead because distributions backport fixes; verify exact package builds against vendor advisories.
Exploitation context
The CVSS vector is network-based, low-complexity, unauthenticated, and requires no user interaction. However, the disclosed evidence is a KASAN finding during mounting, not a demonstrated exploit. The bundle marks the CVE as absent from KEV, and no cited source establishes exploitation in the wild.
Researcher notes
No CWE is supplied. The reproduced condition is a four-byte slab out-of-bounds read in parse_server_interfaces(), reached through SMB3_request_interfaces during mount. The bundle does not establish controlled disclosure, reliable denial of service, or code execution. Treat impacts beyond the KASAN finding and CVSS assessment as unproven.
Mitigation direction
- Apply a vendor kernel update containing the applicable cited upstream stable fix.
- Prioritize systems initiating SMB3 mounts, especially connections to untrusted or externally managed servers.
- Temporarily restrict SMB3 mounts to trusted servers and networks where prompt patching is impossible.
- Review Debian or Siemens guidance when those products are in scope; follow their package-specific remediation.
Validation and detection
- Inventory Linux kernel packages, cifs module use, and configured or observed SMB3 mounts.
- Compare exact kernel package builds with upstream commits and applicable distribution or product advisories.
- Confirm the installed update includes the parse_server_interfaces bounds-check fix.
- Review kernel logs for KASAN, slab-out-of-bounds, parse_server_interfaces, cifs mount failures, or related crashes.
- Retest legitimate SMB3 mounts after updating, without reproducing malformed traffic.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38728 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H3.95.2LinuxVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9bdb8e98a0073c73ab3e6c631ec78877ceb64565CVE reference, Linux
- https://git.kernel.org/stable/c/a0620e1525663edd8c4594f49fb75fe5be4724b0CVE reference, Linux
- https://git.kernel.org/stable/c/8de33d4d72e8fae3502ec3850bd7b14e7c7328b6CVE reference, Linux
- https://git.kernel.org/stable/c/a542f93a123555d09c3ce8bc947f7b56ad8e6463CVE reference, Linux
- https://git.kernel.org/stable/c/f6eda5b0e8f8123564c5b34f5801d63243032eacCVE reference, Linux
- https://git.kernel.org/stable/c/7d34ec36abb84fdfb6632a0f2cbda90379ae21fcCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.