In the Linux kernel, the following vulnerability has been resolved:
pptp: ensure minimal skb length in pptp_xmit()
Commit aabc6596ffb3 ("net: ppp: Add bound checking for skb data on pppsynctxmung") fixed pppsynctxmunge()
We need a similar fix in pptp_xmit(), otherwise we might read uninit data as reported by syzbot.
BUG: KMSAN: uninit-value in pptpxmit+0xc34/0x2720 drivers/net/ppp/pptp.c:193 pptpxmit+0xc34/0x2720 drivers/net/ppp/pptp.c:193 pppchannelbridgeinput drivers/net/ppp/pppgeneric.c:2290 [inline] pppinput+0x1d6/0xe60 drivers/net/ppp/pppgeneric.c:2314 pppoercvcore+0x1e8/0x760 drivers/net/ppp/pppoe.c:379 skbacklogrcv+0x142/0x420 include/net/sock.h:1148 __releasesock+0x1d3/0x330 net/core/sock.c:3213 releasesock+0x6b/0x270 net/core/sock.c:3767 pppoe_sendmsg+0x15d/0xcb0 drivers/net/ppp/pppoe.c:904 socksendmsgnosec net/socket.c:712 [inline] __sock_sendmsg+0x330/0x3d0 net/socket.c:727 ____sys_sendmsg+0x893/0xd80 net/socket.c:2566 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2620 _syssendmmsg+0x2d9/0x7c0 net/socket.c:2709
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38574.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38574.json"
[
{
"signature_version": "v1",
"target": {
"file": "drivers/net/ppp/pptp.c",
"function": "pptp_xmit"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7dcda76fd0615c0599c89f36873a6cd48e02dbb",
"deprecated": false,
"digest": {
"function_hash": "33370514846990204837798120803061228536",
"length": 2673.0
},
"id": "CVE-2025-38574-c190c5f2",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/net/ppp/pptp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7dcda76fd0615c0599c89f36873a6cd48e02dbb",
"deprecated": false,
"digest": {
"line_hashes": [
"44388441029492126185771584853449384376",
"88781259773908989073702521402676898689",
"186616273056157167970464964169978204862",
"284947510952145508655060513235891080762",
"259920482743403447349029837654047059440",
"129210279768559446351627491178429865888",
"70258969616918520612099207757790982107",
"933525736184480332371215249781119921",
"298022836322915723290521480219371970444",
"328994863583839602859171627373486207634",
"296723797741894418792822370895947548603",
"174228782000470827288662521834010140752",
"40344358523342079320444312793316515289",
"339978105444516847586518646600350797905",
"295285456013425583556294105735158513189",
"93465443346597284519930091205458836444",
"260307575110909188375320474507145165088",
"280308891382757026099843250804278923889",
"105561892669578388818891419617763606041",
"310301286579614108380058413688296673404"
],
"threshold": 0.9
},
"id": "CVE-2025-38574-ebbc8b0c",
"signature_type": "Line"
}
]