CVE-2025-38441

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()

syzbot found a potential access to uninit-value in nf_flow_pppoe_proto()

Blamed commit forgot the Ethernet header.

BUG: KMSAN: uninit-value in nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27

nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27

nf_hook_entry_hookfn include/linux/netfilter.h:157 [inline]

nf_hook_slow+0xe1/0x3d0 net/netfilter/core.c:623

nf_hook_ingress include/linux/netfilter_netdev.h:34 [inline]

nf_ingress net/core/dev.c:5742 [inline]

__netif_receive_skb_core+0x4aff/0x70c0 net/core/dev.c:5837

__netif_receive_skb_one_core net/core/dev.c:5975 [inline]

__netif_receive_skb+0xcc/0xac0 net/core/dev.c:6090

netif_receive_skb_internal net/core/dev.c:6176 [inline]

netif_receive_skb+0x57/0x630 net/core/dev.c:6235

tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485

t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References