CVE-2025-38728: Request to add Bugzilla 218602 as a reference

CVE-2025-38728: Request to add Bugzilla 218602 as a reference

[khj]

Hello Linux Kernel CVE Team,

I would like to request a reference update for CVE-2025-38728.

I am not requesting a new CVE ID, reassignment, or reporter
attribution. I am only requesting that the following public Linux
Kernel Bugzilla report be added to the References section of the CVE
record:

https://bugzilla.kernel.org/show_bug.cgi?id=218602

Bugzilla 218602 was reported on March 15, 2024. It describes the
missing bounds validation in parse_server_interfaces(), specifically
that the server-controlled Next value can exceed bytes_left before the
pointer is advanced and the value is subtracted.

The fix associated with CVE-2025-38728 adds the corresponding
validation that rejects a Next value larger than bytes_left:

https://git.kernel.org/stable/c/7d34ec36abb84fdfb6632a0f2cbda90379ae21fc

Could you please review whether Bugzilla 218602 can be added as a
reference to CVE-2025-38728?

Thank you. Regards

Re: CVE-2025-38728: Request to add Bugzilla 218602 as a reference

[Greg KH]

On Wed, Aug 05, 2026 at 04:30:15PM +0900, khj wrote:
> Hello Linux Kernel CVE Team,

Did you send this twice?

And no need to bother MITRE for normal CNA stuff that we can easily
handle.

> I would like to request a reference update for CVE-2025-38728.
> 
> I am not requesting a new CVE ID, reassignment, or reporter
> attribution. I am only requesting that the following public Linux
> Kernel Bugzilla report be added to the References section of the CVE
> record:
> 
> https://bugzilla.kernel.org/show_bug.cgi?id=218602
> 
> Bugzilla 218602 was reported on March 15, 2024. It describes the
> missing bounds validation in parse_server_interfaces(), specifically
> that the server-controlled Next value can exceed bytes_left before the
> pointer is advanced and the value is subtracted.
> 
> The fix associated with CVE-2025-38728 adds the corresponding
> validation that rejects a Next value larger than bytes_left:
> 
> https://git.kernel.org/stable/c/7d34ec36abb84fdfb6632a0f2cbda90379ae21fc
> 
> Could you please review whether Bugzilla 218602 can be added as a
> reference to CVE-2025-38728?

It looks like might be the same issue, but it might not be.  We would
need the cifs maintainers to confirm this or not.

If they do confirm it, great, please send us a patch for the vulns.git
repo on git.kernel.org that adds this as a reference for that CVE entry,
as documented in the cve/schema file.

thanks,

greg k-h