CVE-2025-38728

A flaw was found in the Linux kernel's Server Message Block (SMB) client. A missing bounds check in the parse_server_interfaces() function allows an out-of-bounds read on slab memory when parsing server interfaces during a share mount. A local user could exploit this vulnerability to cause a denial of service (DoS) by crashing the system, or potentially disclose sensitive kernel memory.

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux because successful exploitation requires an administrative or privileged local user to initiate a mount operation against an untrusted SMB server, limiting the direct blast radius. In typical deployments, the CIFS kernel module is loaded on demand only when mounting remote shares, meaning systems that do not use network file sharing remain unexposed. Although an out-of-bounds memory read can lead to a kernel crash or information disclosure, the prerequisite of connecting to a hostile endpoint prevents direct unauthenticated remote exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.