CVE-2025-38728: Request to add Bugzilla 218602 as a reference

khj <[email protected]>
Newsgroups org.kernel.vger.linux-cifs
Message-ID <CAGr5VtPLAy_N0N4kE5TDndMr3zYukVXDHD49AfToGoa-vMk24A@mail.gmail.com>
Hello Linux Kernel CVE Team,

I would like to request a reference update for CVE-2025-38728.

I am not requesting a new CVE ID, reassignment, or reporter
attribution. I am only requesting that the following public Linux
Kernel Bugzilla report be added to the References section of the CVE
record:

https://bugzilla.kernel.org/show_bug.cgi?id=218602

Bugzilla 218602 was reported on March 15, 2024. It describes the
missing bounds validation in parse_server_interfaces(), specifically
that the server-controlled Next value can exceed bytes_left before the
pointer is advanced and the value is subtracted.

The fix associated with CVE-2025-38728 adds the corresponding
validation that rejects a Next value larger than bytes_left:

https://git.kernel.org/stable/c/7d34ec36abb84fdfb6632a0f2cbda90379ae21fc

Could you please review whether Bugzilla 218602 can be added as a
reference to CVE-2025-38728?

Thank you. Regards
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.