In the Linux kernel, the following vulnerability has been resolved:
smb3: fix for slab out of bounds on mount to ksmbd
With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see below):
BUG: KASAN: slab-out-of-bounds in parse_server_interfaces+0x14ee/0x1880 [cifs] Read of size 4 at addr ffff8881433dba98 by task mount/9827
CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. Precision Tower 3620/0MWYPT, BIOS 2.13.1 06/14/2019 Call Trace: <TASK> dump_stack_lvl+0x9f/0xf0 print_report+0xd1/0x670 __virt_addr_valid+0x22c/0x430 ? parse_server_interfaces+0x14ee/0x1880 [cifs] ? kasan_complete_mode_report_info+0x2a/0x1f0 ? parse_server_interfaces+0x14ee/0x1880 [cifs] kasan_report+0xd6/0x110 parse_server_interfaces+0x14ee/0x1880 [cifs] __asan_report_load_n_noabort+0x13/0x20 parse_server_interfaces+0x14ee/0x1880 [cifs] ? __pfx_parse_server_interfaces+0x10/0x10 [cifs] ? trace_hardirqs_on+0x51/0x60 SMB3_request_interfaces+0x1ad/0x3f0 [cifs] ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs] ? SMB2_tcon+0x23c/0x15d0 [cifs] smb3_qfs_tcon+0x173/0x2b0 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] ? cifs_get_tcon+0x105d/0x2120 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_get_tcon+0x105d/0x2120 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] cifs_mount_get_tcon+0x369/0xb90 [cifs] ? dfs_cache_find+0xe7/0x150 [cifs] dfs_mount_share+0x985/0x2970 [cifs] ? check_path.constprop.0+0x28/0x50 ? save_trace+0x54/0x370 ? __pfx_dfs_mount_share+0x10/0x10 [cifs] ? __lock_acquire+0xb82/0x2ba0 ? __kasan_check_write+0x18/0x20 cifs_mount+0xbc/0x9e0 [cifs] ? __pfx_cifs_mount+0x10/0x10 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_setup_cifs_sb+0x29d/0x810 [cifs] cifs_smb3_do_mount+0x263/0x1990 [cifs]
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-toolsUpgrade kernel6.12-modules-extra-commonUpgrade python3-perf-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel-modules-extraUpgrade kernel6.12-libbpf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-develUpgrade kernel6.12Upgrade kernel6.12-headersUpgrade perf6.12Upgrade bpftool-debuginfoUpgrade kernel-headersUpgrade bpftoolUpgrade kernel6.12-debuginfoUpgrade kernelUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-libbpf-develUpgrade kernel-libbpf-debuginfoUpgrade kernel6.12-tools-develUpgrade perf6.12-debuginfoUpgrade kernel6.12-libbpfUpgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade perfUpgrade kernel-develUpgrade kernel6.12-modules-extraUpgrade kernel6.12-libbpf-staticUpgrade bpftool6.12-debuginfoUpgrade perf-debuginfoUpgrade kernel-libbpfUpgrade bpftool6.12Upgrade python3-perf6.12Upgrade kernel-modules-extra-commonUpgrade kernel-livepatch-6.12.46-66.121Upgrade python3-perf6.12-debuginfoUpgrade kernel6.12-tools-debuginfoUpgrade kernel6.12-toolsUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-livepatch-6.1.150-174.273Upgrade kernel-debuginfo-common-aarch64Upgrade python3-perfUpgrade kernel6.12-devel | Sep 30, 2025 | Sep 4, 2025 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Sep 25, 2025 | Sep 25, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernelUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade bpftool | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernelUpgrade bpftoolUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libs | Feb 3, 2026 | Feb 2, 2026 |
| Oracle_linux | — | Upgrade kernel-uek | Oct 16, 2025 | Sep 4, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Sep 4, 2025 |
| Ubuntu | — | Upgrade linux-image-lowlatency-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-aws-lts-24.04Upgrade linux-image-generic-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-azureUpgrade linux-image-6.8.0-1046-awsUpgrade linux-image-xilinx-6.8Upgrade linux-image-6.8.0-1046-azureUpgrade linux-image-oem-22.04cUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-raspiUpgrade linux-image-oracle-6.8Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-virtual-6.8Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-raspi-6.8Upgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-aws-fipsUpgrade linux-image-gcp-64kUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-azure-fipsUpgrade linux-image-fipsUpgrade linux-image-genericUpgrade linux-image-gke-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-lowlatency-6.8Upgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-gke-64k-6.8Upgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-gke-64kUpgrade linux-image-generic-64k-6.8Upgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-aws-6.8Upgrade linux-image-6.8.0-100-genericUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-awsUpgrade linux-image-gcp-fipsUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-xilinxUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gcpUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-azure-6.8Upgrade linux-image-nvidiaUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-aws-fips-6.8Upgrade linux-image-realtimeUpgrade linux-image-aws-64kUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-fips-6.8Upgrade linux-image-oracleUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-azure-fips-6.8Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-gkeUpgrade linux-image-azure-lts-24.04Upgrade linux-image-generic-6.8Upgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-aws-64k-6.8Upgrade linux-image-gkeopUpgrade linux-image-oem-22.04bUpgrade linux-image-virtualUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-intel-iotgUpgrade linux-image-ibmUpgrade linux-image-gcp-6.8Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-ibm-classicUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-ibm-6.8Upgrade linux-image-raspi-realtimeUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-oracle-64k | Feb 12, 2026 | Sep 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 30, 2025 | Sep 4, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub