CVE-2025-38639

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_nfacct: don't assume acct name is null-terminated

BUG: KASAN: slab-out-of-bounds in .. lib/vsprintf.c:721 Read of size 1 at addr ffff88801eac95c8 by task syz-executor183/5851 [..] string+0x231/0x2b0 lib/vsprintf.c:721 vsnprintf+0x739/0xf00 lib/vsprintf.c:2874 [..] nfacct_mt_checkentry+0xd2/0xe0 net/netfilter/xt_nfacct.c:41 xt_check_match+0x3d1/0xab0 net/netfilter/x_tables.c:523

nfnl_acct_find_get() handles non-null input, but the error printk relied on its presence.

This vulnerability is rated Moderate because exploitation requires local administrative privileges (specifically CAP_NET_ADMIN) to add or alter netfilter rules, constraining the attack surface to privileged users or containers with elevated network capabilities. By registering an invalid accounting rule with a non-null-terminated name string, an attacker can trigger an out-of-bounds read in the kernel error reporting routine, causing a kernel panic and denial of service. The flaw cannot be exploited remotely and does not compromise system confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.