In the Linux kernel, the following vulnerability has been resolved:
smb3: fix for slab out of bounds on mount to ksmbd
With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see below):
BUG: KASAN: slab-out-of-bounds in parse_server_interfaces+0x14ee/0x1880 [cifs] Read of size 4 at addr ffff8881433dba98 by task mount/9827
CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. Precision Tower 3620/0MWYPT, BIOS 2.13.1 06/14/2019 Call Trace: <TASK> dump_stack_lvl+0x9f/0xf0 print_report+0xd1/0x670 __virt_addr_valid+0x22c/0x430 ? parse_server_interfaces+0x14ee/0x1880 [cifs] ? kasan_complete_mode_report_info+0x2a/0x1f0 ? parse_server_interfaces+0x14ee/0x1880 [cifs] kasan_report+0xd6/0x110 parse_server_interfaces+0x14ee/0x1880 [cifs] __asan_report_load_n_noabort+0x13/0x20 parse_server_interfaces+0x14ee/0x1880 [cifs] ? __pfx_parse_server_interfaces+0x10/0x10 [cifs] ? trace_hardirqs_on+0x51/0x60 SMB3_request_interfaces+0x1ad/0x3f0 [cifs] ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs] ? SMB2_tcon+0x23c/0x15d0 [cifs] smb3_qfs_tcon+0x173/0x2b0 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] ? cifs_get_tcon+0x105d/0x2120 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_get_tcon+0x105d/0x2120 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] cifs_mount_get_tcon+0x369/0xb90 [cifs] ? dfs_cache_find+0xe7/0x150 [cifs] dfs_mount_share+0x985/0x2970 [cifs] ? check_path.constprop.0+0x28/0x50 ? save_trace+0x54/0x370 ? __pfx_dfs_mount_share+0x10/0x10 [cifs] ? __lock_acquire+0xb82/0x2ba0 ? __kasan_check_write+0x18/0x20 cifs_mount+0xbc/0x9e0 [cifs] ? __pfx_cifs_mount+0x10/0x10 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_setup_cifs_sb+0x29d/0x810 [cifs] cifs_smb3_do_mount+0x263/0x1990 [cifs]
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-libbpf-staticUpgrade kernel6.12Upgrade kernel-toolsUpgrade python3-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-headersUpgrade kernel6.12-debuginfo-common-aarch64Upgrade bpftoolUpgrade kernelUpgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-headersUpgrade perf6.12Upgrade kernel-libbpf-develUpgrade kernel-modules-extraUpgrade kernel6.12-libbpf-debuginfoUpgrade kernel6.12-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modules-extra-commonUpgrade kernel6.12-modules-extraUpgrade kernel-livepatch-6.1.150-174.273Upgrade bpftool6.12Upgrade kernel-tools-develUpgrade kernel-livepatch-6.12.46-66.121Upgrade kernel-libbpfUpgrade python3-perf6.12Upgrade kernel-debuginfo-common-aarch64Upgrade python3-perfUpgrade kernel-libbpf-debuginfoUpgrade kernel6.12-tools-develUpgrade kernel6.12-develUpgrade kernel6.12-toolsUpgrade kernel6.12-libbpf-staticUpgrade bpftool6.12-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel6.12-libbpfUpgrade kernel-tools-debuginfoUpgrade perfUpgrade kernel6.12-libbpf-develUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel-develUpgrade kernel6.12-tools-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64 | Sep 30, 2025 | Sep 4, 2025 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Sep 25, 2025 | Sep 25, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade bpftoolUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade python3-perf | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade bpftoolUpgrade kernel-tools-libs | Feb 3, 2026 | Feb 2, 2026 |
| Oracle_linux | — | Upgrade kernel-uek | Oct 16, 2025 | Sep 4, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Sep 4, 2025 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-raspiUpgrade linux-image-genericUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-xilinx-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-6.8.0-1046-awsUpgrade linux-image-aws-6.8Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-azureUpgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-gke-6.8Upgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-fipsUpgrade linux-image-gcp-64kUpgrade linux-image-oem-22.04Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-1046-azureUpgrade linux-image-azure-fipsUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-aws-fipsUpgrade linux-image-gcp-fipsUpgrade linux-image-oracle-6.8Upgrade linux-image-awsUpgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-realtime-6.8.1Upgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-gke-64k-6.8Upgrade linux-image-lowlatency-6.8Upgrade linux-image-virtual-6.8Upgrade linux-image-generic-64k-6.8Upgrade linux-image-gke-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-raspi-6.8Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-ibm-6.8Upgrade linux-image-ibmUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-gcp-6.8Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-oem-22.04bUpgrade linux-image-lowlatencyUpgrade linux-image-raspi-realtimeUpgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-fips-6.8Upgrade linux-image-gkeop-6.8Upgrade linux-image-gkeopUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-aws-64kUpgrade linux-image-realtimeUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-xilinxUpgrade linux-image-gcpUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-aws-fips-6.8Upgrade linux-image-oracleUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-kvmUpgrade linux-image-generic-6.8Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-azure-6.8Upgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-gkeUpgrade linux-image-nvidiaUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-azure-fips-6.8Upgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-generic-lpaeUpgrade linux-image-ibm-classic | Feb 12, 2026 | Sep 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 30, 2025 | Sep 4, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub