CVE-2025-38639

Katalog CVE

CVSS 5.5 · Medium EPSS 0,18%

Kerentanan pada linux kernel, debian linux. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_nfacct: don't assume acct name is null-terminated BUG: KASAN: slab-out-of-bounds in .. lib/vsprintf.c:721 Read of size 1 at addr ffff88801eac95c8 by task syz-executor183/5851 [..] string+0x231/0x2b0 lib/vsprintf.c:721 vsnprintf+0x739/0xf00 lib/vsprintf.c:2874 [..] nfacct_mt_checkentry+0xd2/0xe0 net/netfilter/xt_nfacct.c:41 xt_check_match+0x3d1/0xab0 net/netfilter/x_tables.c:523 nfnl_acct_find_get() handles non-null input, but the error printk relied on its presence.

Rincian

Terbit di NVD

22 Agustus 2025

Terakhir diubah

30 Juli 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.kernel.org/stable/c/58004aa21e79addaf41667bfe65e93ec51653f18 patch
• https://git.kernel.org/stable/c/58007fc7b94fb2702000045ff401eb7f5bde7828 patch
• https://git.kernel.org/stable/c/66d41268ede1e1b6e71ba28be923397ff0b2b9c3 patch
• https://git.kernel.org/stable/c/7c1ae471da69c09242834e956218ea6a42dd405a patch
• https://git.kernel.org/stable/c/b10cfa2de13d28ddd03210eb234422b7ec92725a patch
• https://git.kernel.org/stable/c/bf58e667af7d96c8eb9411f926a0a0955f41ce21 patch
• https://git.kernel.org/stable/c/df13c9c6ce1d55c31d1bd49db65a7fbbd86aab13 patch
• https://git.kernel.org/stable/c/e021a1eee196887536a6630c5492c23a4c78d452 patch
• https://git.kernel.org/stable/c/e18939176e657a3a20bfbed357b8c55a9f82aba3 patch
• https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html advisory pihak ketiga