Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem (Netfilter) that could allow a local user to cause a system crash or potentially access sensitive information from the computer's memory. The issue occurs when the system attempts to log an error message related to network accounting but fails to properly handle the data, leading to an out-of-bounds memory read. This could impact the stability of the server or lead to unauthorized data exposure.
Technical details
A slab-out-of-bounds read vulnerability exists in net/netfilter/xt_nfacct.c within the nfacct_mt_checkentry function. The root cause is that the code assumes the accounting object name (info->name) is null-terminated when passing it to pr_info_ratelimited for error logging. A local attacker can provide a non-null-terminated string, causing vsnprintf to read past the intended buffer boundary. This can result in a kernel panic (DoS) or the leakage of sensitive kernel memory contents. The issue has been addressed in multiple stable kernel branches by using a precision specifier (%.*s) in the printk format string to limit the read to NFACCT_NAME_MAX.
Affected products
- Linux Linux Kernel 3.3 to 6.10.x
Timeline
- 2025-07-18: patched: Initial patch authored by Florian Westphal
- 2025-08-22: disclosed: CVE-2025-38639 published
References
- https://git.kernel.org/stable/c/58004aa21e79addaf41667bfe65e93ec51653f18
- https://git.kernel.org/stable/c/58007fc7b94fb2702000045ff401eb7f5bde7828
- https://git.kernel.org/stable/c/66d41268ede1e1b6e71ba28be923397ff0b2b9c3
- https://git.kernel.org/stable/c/7c1ae471da69c09242834e956218ea6a42dd405a
- https://git.kernel.org/stable/c/b10cfa2de13d28ddd03210eb234422b7ec92725a
- https://git.kernel.org/stable/c/bf58e667af7d96c8eb9411f926a0a0955f41ce21
- https://git.kernel.org/stable/c/df13c9c6ce1d55c31d1bd49db65a7fbbd86aab13