Executive brief
A vulnerability was identified in the Linux kernel's Point-to-Point Tunneling Protocol (PPTP) implementation. This component is used to manage secure virtual private network (VPN) connections. An attacker could potentially exploit this flaw to cause a system crash or gain unauthorized access to small amounts of sensitive kernel memory, impacting the stability and security of the network connection.
Technical details
A flaw exists in the pptp_xmit() function within drivers/net/ppp/pptp.c due to a lack of proper bounds checking on socket buffer (skb) data. Specifically, the function fails to ensure a minimal length before accessing protocol fields and LCP codes, leading to an uninitialized-value read as detected by KMSAN. An attacker can trigger this by sending specially crafted packets over a PPTP connection. This can result in a kernel oops (denial of service) or the leakage of uninitialized kernel memory. The issue has been resolved by implementing pskb_may_pull() checks to verify data length before access.
Affected products
- Linux Linux Kernel 2.6.12 through 6.15.x
Timeline
- 2025-07-29: disclosed: Vulnerability reported and patch authored by Eric Dumazet.
- 2025-08-15: patched: Patch committed to multiple stable kernel branches.
- 2025-08-19: advisory: CVE-2025-38574 published.
References
- https://git.kernel.org/stable/c/1a04db0fd75cb6034fc27a56b67b3b8b9022a98c
- https://git.kernel.org/stable/c/26672f1679b143aa34fca0b6046b7fd0c184770d
- https://git.kernel.org/stable/c/5005d24377378a20e5c0e53052fc4ebdcdcbc611
- https://git.kernel.org/stable/c/504cc4ab91073d2ac7404ad146139f86ecee7193
- https://git.kernel.org/stable/c/5de7513f38f3c19c0610294ee478242bea356f8c
- https://git.kernel.org/stable/c/97b8c5d322c5c0038cac4bc56fdbe237d0be426f
- https://git.kernel.org/stable/c/b7dcda76fd0615c0599c89f36873a6cd48e02dbb