CVE-2025-38728: Request to add Bugzilla 218602 as a reference
khj <[email protected]>
| Newsgroups | org.kernel.vger.linux-cifs |
|---|---|
| Message-ID | <CAGr5VtPLAy_N0N4kE5TDndMr3zYukVXDHD49AfToGoa-vMk24A@mail.gmail.com> |
Hello Linux Kernel CVE Team, I would like to request a reference update for CVE-2025-38728. I am not requesting a new CVE ID, reassignment, or reporter attribution. I am only requesting that the following public Linux Kernel Bugzilla report be added to the References section of the CVE record: https://bugzilla.kernel.org/show_bug.cgi?id=218602 Bugzilla 218602 was reported on March 15, 2024. It describes the missing bounds validation in parse_server_interfaces(), specifically that the server-controlled Next value can exceed bytes_left before the pointer is advanced and the value is subtracted. The fix associated with CVE-2025-38728 adds the corresponding validation that rejects a Next value larger than bytes_left: https://git.kernel.org/stable/c/7d34ec36abb84fdfb6632a0f2cbda90379ae21fc Could you please review whether Bugzilla 218602 can be added as a reference to CVE-2025-38728? Thank you. Regards