CVE-2025-38441
netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() syzbot found a potential access to uninit-value in nf_flow_pppoe_proto() Blamed commit forgot the Ethernet header. BUG: KMSAN: uninit-value in nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27 nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27 nf_hook_entry_hookfn include/linux/netfilter.h:157 [inline] nf_hook_slow+0xe1/0x3d0 net/netfilter/core.c:623 nf_hook_ingress include/linux/netfilter_netdev.h:34 [inline] nf_ingress net/core/dev.c:5742 [inline] __netif_receive_skb_core+0x4aff/0x70c0 net/core/dev.c:5837 __netif_receive_skb_one_core net/core/dev.c:5975 [inline] __netif_receive_skb+0xcc/0xac0 net/core/dev.c:6090 netif_receive_skb_internal net/core/dev.c:6176 [inline] netif_receive_skb+0x57/0x630 net/core/dev.c:6235 tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485 tun_get_user+0x4ee0/0x6b40 drivers/net/tun.c:1938 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1984 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xb4b/0x1580 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline]
Fixes and workarounds
No remediation reported in collected sources.
Missing remediation information is not evidence that no patch exists.
Affected products and versions
| Product | Versions | Authority |
|---|---|---|
| Linux Linux |
≥ d06977b9a4109f8738bb276125eb6a0b772bc433; < a3aea97d55964e70a1e6426aa4cafdc036e8a2dd (affected, git) ≥ 8bf7c76a2a207ca2b4cfda0a279192adf27678d7; < eed8960b289327235185b7c32649c3470a3e969b (affected, git) ≥ a2471d271042ea18e8a6babc132a8716bb2f08b9; < 9fbc49429a23b02595ba82536c5ea425fdabb221 (affected, git) ≥ 87b3593bed1868b2d9fe096c01bcdf0ea86cbebf; < e0dd2e9729660f3f4fcb16e0aef87342911528ef (affected, git) ≥ 87b3593bed1868b2d9fe096c01bcdf0ea86cbebf; < cfbf0665969af2c69d10c377d4c3d306e717efb4 (affected, git) ≥ 87b3593bed1868b2d9fe096c01bcdf0ea86cbebf; < 18cdb3d982da8976b28d57691eb256ec5688fad2 (affected, git) cf366ee3bc1b7d1c76a882640ba3b3f8f1039163 (affected, git) ≥ 5.15.157; < 5.15.189 (affected, semver) ≥ 6.1.88; < 6.1.146 (affected, semver) ≥ 6.6.29; < 6.6.99 (affected, semver) ≥ 6.8.8; < 6.9 (affected, semver) Other versions: unaffected |
CNA: Linux |
| Linux Linux |
6.9 (affected) ≥ 0; < 6.9 (unaffected, semver) ≥ 5.15.189; ≤ 5.15.* (unaffected, semver) ≥ 6.1.146; ≤ 6.1.* (unaffected, semver) ≥ 6.6.99; ≤ 6.6.* (unaffected, semver) ≥ 6.12.39; ≤ 6.12.* (unaffected, semver) ≥ 6.15.7; ≤ 6.15.* (unaffected, semver) ≥ 6.16; ≤ * (unaffected, original_commit_for_fix) Other versions: affected |
CNA: Linux |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
No CVSS assessment reported. An unscored record is not a low-severity determination.
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://git.kernel.org/stable/c/a3aea97d55964e70a1e6426aa4cafdc036e8a2ddCNA: Linux
- https://git.kernel.org/stable/c/eed8960b289327235185b7c32649c3470a3e969bCNA: Linux
- https://git.kernel.org/stable/c/9fbc49429a23b02595ba82536c5ea425fdabb221CNA: Linux
- https://git.kernel.org/stable/c/e0dd2e9729660f3f4fcb16e0aef87342911528efCNA: Linux
- https://git.kernel.org/stable/c/cfbf0665969af2c69d10c377d4c3d306e717efb4CNA: Linux
- https://git.kernel.org/stable/c/18cdb3d982da8976b28d57691eb256ec5688fad2CNA: Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlADP: CVE
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.