CVE-2025-38441 Details
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() syzbot found a potential access to uninit-value in nf_flow_pppoe_proto() Blamed commit forgot the Ethernet header. BUG: KMSAN: uninit-value in nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27 nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27 nf_hook_entry_hookfn include/linux/netfilter.h:157 [inline] nf_hook_slow+0xe1/0x3d0 net/netfilter/core.c:623 nf_hook_ingress include/linux/netfilter_netdev.h:34 [inline] nf_ingress net/core/dev.c:5742 [inline] __netif_receive_skb_core+0x4aff/0x70c0 net/core/dev.c:5837 __netif_receive_skb_one_core net/core/dev.c:5975 [inline] __netif_receive_skb+0xcc/0xac0 net/core/dev.c:6090 netif_receive_skb_internal net/core/dev.c:6176 [inline] netif_receive_skb+0x57/0x630 net/core/dev.c:6235 tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485 tun_get_user+0x4ee0/0x6b40 drivers/net/tun.c:1938 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1984 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xb4b/0x1580 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline]
A vulnerability in the Linux kernel's netfilter component can lead to the use of uninitialized values in the flowtable's PPPoE protocol handling. This issue arises because the code fails to account for the Ethernet header, potentially causing incorrect flow offloading decisions. The vulnerability has been addressed by modifying the header validation to include the Ethernet header length.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched kernel can be found on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/18cdb3d982da8976b28d57691eb256ec5688fad2 | kernel.org | Patch |
| https://git.kernel.org/stable/c/9fbc49429a23b02595ba82536c5ea425fdabb221 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a3aea97d55964e70a1e6426aa4cafdc036e8a2dd | kernel.org | Patch |
| https://git.kernel.org/stable/c/cfbf0665969af2c69d10c377d4c3d306e717efb4 | kernel.org | Patch |
| https://git.kernel.org/stable/c/e0dd2e9729660f3f4fcb16e0aef87342911528ef | kernel.org | Patch |
| https://git.kernel.org/stable/c/eed8960b289327235185b7c32649c3470a3e969b | kernel.org | Patch |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html | CVE | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-908 | Use of Uninitialized Resource | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.15.157, < 5.15.189 >= 6.1.88, < 6.1.146 >= 6.6.29, < 6.6.99 >= 6.8.8, < 6.9 >= 6.9.1, < 6.12.39 >= 6.13, < 6.15.7 6.9 - 6.9 rc5 6.9 rc6 6.9 rc7 6.16 rc1 6.16 rc2 6.16 rc3 6.16 rc4 6.16 rc5 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Dec 22, 2025 | Initial Analysis | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Jul 25, 2025 | New CVE Received | kernel.org |