In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: account for Ethernet header in nfflowpppoe_proto()
syzbot found a potential access to uninit-value in nfflowpppoe_proto()
Blamed commit forgot the Ethernet header.
BUG: KMSAN: uninit-value in nfflowoffloadinethook+0x7e4/0x940 net/netfilter/nfflowtableinet.c:27 nfflowoffloadinethook+0x7e4/0x940 net/netfilter/nfflowtableinet.c:27 nfhookentryhookfn include/linux/netfilter.h:157 [inline] nfhookslow+0xe1/0x3d0 net/netfilter/core.c:623 nfhookingress include/linux/netfilternetdev.h:34 [inline] nfingress net/core/dev.c:5742 [inline] _netifreceiveskbcore+0x4aff/0x70c0 net/core/dev.c:5837 _netifreceiveskbonecore net/core/dev.c:5975 [inline] _netifreceiveskb+0xcc/0xac0 net/core/dev.c:6090 netifreceiveskbinternal net/core/dev.c:6176 [inline] netifreceiveskb+0x57/0x630 net/core/dev.c:6235 tunrxbatched+0x1df/0x980 drivers/net/tun.c:1485 tungetuser+0x4ee0/0x6b40 drivers/net/tun.c:1938 tunchrwriteiter+0x3e9/0x5c0 drivers/net/tun.c:1984 newsyncwrite fs/readwrite.c:593 [inline] vfswrite+0xb4b/0x1580 fs/readwrite.c:686 ksyswrite fs/readwrite.c:738 [inline] _dosyswrite fs/readwrite.c:749 [inline]
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38441.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38441.json"
[
{
"id": "CVE-2025-38441-009af18b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"47337715065676330044825099628781738846",
"210540963209817581631752203928855740661",
"54757703481627026555935427491649202216",
"175106729807013295156903967064789924179"
]
},
"signature_type": "Line",
"target": {
"file": "include/net/netfilter/nf_flow_table.h"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3aea97d55964e70a1e6426aa4cafdc036e8a2dd",
"deprecated": false
},
{
"id": "CVE-2025-38441-227853e0",
"digest": {
"threshold": 0.9,
"line_hashes": [
"47337715065676330044825099628781738846",
"210540963209817581631752203928855740661",
"54757703481627026555935427491649202216",
"175106729807013295156903967064789924179"
]
},
"signature_type": "Line",
"target": {
"file": "include/net/netfilter/nf_flow_table.h"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfbf0665969af2c69d10c377d4c3d306e717efb4",
"deprecated": false
},
{
"id": "CVE-2025-38441-48ce09ac",
"digest": {
"length": 171.0,
"function_hash": "328215630746005765259524757518520894856"
},
"signature_type": "Function",
"target": {
"file": "include/net/netfilter/nf_flow_table.h",
"function": "nf_flow_pppoe_proto"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfbf0665969af2c69d10c377d4c3d306e717efb4",
"deprecated": false
},
{
"id": "CVE-2025-38441-702dc670",
"digest": {
"length": 171.0,
"function_hash": "328215630746005765259524757518520894856"
},
"signature_type": "Function",
"target": {
"file": "include/net/netfilter/nf_flow_table.h",
"function": "nf_flow_pppoe_proto"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3aea97d55964e70a1e6426aa4cafdc036e8a2dd",
"deprecated": false
},
{
"id": "CVE-2025-38441-7879bcc6",
"digest": {
"length": 171.0,
"function_hash": "328215630746005765259524757518520894856"
},
"signature_type": "Function",
"target": {
"file": "include/net/netfilter/nf_flow_table.h",
"function": "nf_flow_pppoe_proto"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eed8960b289327235185b7c32649c3470a3e969b",
"deprecated": false
},
{
"id": "CVE-2025-38441-7c648c57",
"digest": {
"length": 171.0,
"function_hash": "328215630746005765259524757518520894856"
},
"signature_type": "Function",
"target": {
"file": "include/net/netfilter/nf_flow_table.h",
"function": "nf_flow_pppoe_proto"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0dd2e9729660f3f4fcb16e0aef87342911528ef",
"deprecated": false
},
{
"id": "CVE-2025-38441-80fb0cb9",
"digest": {
"length": 171.0,
"function_hash": "328215630746005765259524757518520894856"
},
"signature_type": "Function",
"target": {
"file": "include/net/netfilter/nf_flow_table.h",
"function": "nf_flow_pppoe_proto"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18cdb3d982da8976b28d57691eb256ec5688fad2",
"deprecated": false
},
{
"id": "CVE-2025-38441-89343dd1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"47337715065676330044825099628781738846",
"210540963209817581631752203928855740661",
"54757703481627026555935427491649202216",
"175106729807013295156903967064789924179"
]
},
"signature_type": "Line",
"target": {
"file": "include/net/netfilter/nf_flow_table.h"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18cdb3d982da8976b28d57691eb256ec5688fad2",
"deprecated": false
},
{
"id": "CVE-2025-38441-aa768bf9",
"digest": {
"length": 171.0,
"function_hash": "328215630746005765259524757518520894856"
},
"signature_type": "Function",
"target": {
"file": "include/net/netfilter/nf_flow_table.h",
"function": "nf_flow_pppoe_proto"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9fbc49429a23b02595ba82536c5ea425fdabb221",
"deprecated": false
},
{
"id": "CVE-2025-38441-c0a4e069",
"digest": {
"threshold": 0.9,
"line_hashes": [
"47337715065676330044825099628781738846",
"210540963209817581631752203928855740661",
"54757703481627026555935427491649202216",
"175106729807013295156903967064789924179"
]
},
"signature_type": "Line",
"target": {
"file": "include/net/netfilter/nf_flow_table.h"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0dd2e9729660f3f4fcb16e0aef87342911528ef",
"deprecated": false
},
{
"id": "CVE-2025-38441-ff469e61",
"digest": {
"threshold": 0.9,
"line_hashes": [
"47337715065676330044825099628781738846",
"210540963209817581631752203928855740661",
"54757703481627026555935427491649202216",
"175106729807013295156903967064789924179"
]
},
"signature_type": "Line",
"target": {
"file": "include/net/netfilter/nf_flow_table.h"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9fbc49429a23b02595ba82536c5ea425fdabb221",
"deprecated": false
},
{
"id": "CVE-2025-38441-ff774171",
"digest": {
"threshold": 0.9,
"line_hashes": [
"47337715065676330044825099628781738846",
"210540963209817581631752203928855740661",
"54757703481627026555935427491649202216",
"175106729807013295156903967064789924179"
]
},
"signature_type": "Line",
"target": {
"file": "include/net/netfilter/nf_flow_table.h"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eed8960b289327235185b7c32649c3470a3e969b",
"deprecated": false
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38441.json"
[
{
"id": "CVE-2025-38441-8b1932d2",
"digest": {
"length": 7121.0,
"function_hash": "80901189361500634894015890542676957152"
},
"signature_type": "Function",
"target": {
"file": "servconf.c",
"function": "fill_default_server_options"
},
"signature_version": "v1",
"source": "https://github.com/openssh/openssh-portable/commit/7de4b03a6e4071d454b72927ffaf52949fa34545",
"deprecated": false
},
{
"id": "CVE-2025-38441-c8d26662",
"digest": {
"threshold": 0.9,
"line_hashes": [
"186023089215617829128658093752918424562",
"5696258939078387472526837787278119894",
"335658113453374880815717633977241551309",
"97615594512916947641653856088728693898",
"168295098526326141749787243176456237566"
]
},
"signature_type": "Line",
"target": {
"file": "servconf.c"
},
"signature_version": "v1",
"source": "https://github.com/openssh/openssh-portable/commit/7de4b03a6e4071d454b72927ffaf52949fa34545",
"deprecated": false
}
]