CVE-2025-38441

Medium

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() syzbot found a potential access to uninit-value in nf_flow_pppoe_proto() Blamed commit forgot the Ethernet header. BUG: KMSAN: uninit-value in nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27 nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27 nf_hook_entry_hookfn include/linux/netfilter.h:157 [inline] nf_hook_slow+0xe1/0x3d0 net/netfilter/core.c:623 nf_hook_ingress include/linux/netfilter_netdev.h:34 [inline] nf_ingress net/core/dev.c:5742 [inline] __netif_receive_skb_core+0x4aff/0x70c0 net/core/dev.c:5837 __netif_receive_skb_one_core net/core/dev.c:5975 [inline] __netif_receive_skb+0xcc/0xac0 net/core/dev.c:6090 netif_receive_skb_internal net/core/dev.c:6176 [inline] netif_receive_skb+0x57/0x630 net/core/dev.c:6235 tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485 tun_get_user+0x4ee0/0x6b40 drivers/net/tun.c:1938 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1984 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xb4b/0x1580 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline]

Package Linux Kernel
Published 2025-07-25
Last modified 2025-12-22
CVSS version 3.1
Patch available
Yes

CVSS 3.1 score

5.5

out of 10
Medium
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness type

CWE-908

CVE-2025-38441 is classified as CWE-908

See CWE-908 on MITRE CWE for full details on this weakness type.

Affected versions

Linux kernel versions 5.15.157, 6.1.88, 6.6.29, 6.8.8, 6.9 and later are affected. Fixed in 5.15.189, 6.1.146, 6.6.99, 6.12.39, 6.15.7, 6.16 and their respective stable series.

Affected from
≥ 5.15.157 ≥ 6.1.88 ≥ 6.6.29 ≥ 6.8.8 ≥ 6.9
Fixed in
✓ 5.15.189 5.15.x ✓ 6.1.146 6.1.x ✓ 6.6.99 6.6.x ✓ 6.12.39 6.12.x ✓ 6.15.7 6.15.x ✓ 6.16

References

The following references provide additional information about CVE-2025-38441 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.

6 patch commits total View all on NVD

Frequently asked questions

  • What is CVE-2025-38441?

    CVE-2025-38441 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 . It affects Linux kernel versions from 5.15.157 onward and has been patched in 5.15.189, 6.1.146, 6.6.99 and others. CVE-2025-38441 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

  • What is the CVSS score for CVE-2025-38441?

    CVE-2025-38441 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H .

  • Is there a patch available for CVE-2025-38441?

    Yes — CVE-2025-38441 has been patched. Fixed versions include 5.15.189, 6.1.146, 6.6.99 and others. If you are running Linux kernel 5.15.157 or later up to the fix versions, apply the relevant patch for your kernel branch.

  • Is CVE-2025-38441 actively exploited?

    No — CVE-2025-38441 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Back to
All CVEs
View on
NVD / NIST