CVE-2025-38639

netfilter: xt_nfacct: don't assume acct name is null-terminated

State: Published
Severity: 7.1 High
Published: Aug 22, 2025
Updated: Oct 15, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_nfacct: don't assume acct name is null-terminated

BUG: KASAN: slab-out-of-bounds in .. lib/vsprintf.c:721 Read of size 1 at addr ffff88801eac95c8 by task syz-executor183/5851 [..] string+0x231/0x2b0 lib/vsprintf.c:721 vsnprintf+0x739/0xf00 lib/vsprintf.c:2874 [..] nfacct_mt_checkentry+0xd2/0xe0 net/netfilter/xt_nfacct.c:41 xt_check_match+0x3d1/0xab0 net/netfilter/x_tables.c:523

nfnl_acct_find_get() handles non-null input, but the error printk relied on its presence.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 to before 66d41268ede1e1b6e71ba28be923397ff0b2b9c3Affected ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 to before e021a1eee196887536a6630c5492c23a4c78d452Affected ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 to before b10cfa2de13d28ddd03210eb234422b7ec92725aAffected ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 to before e18939176e657a3a20bfbed357b8c55a9f82aba3Affected ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 to before 58004aa21e79addaf41667bfe65e93ec51653f18Affected ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 to before 7c1ae471da69c09242834e956218ea6a42dd405aAffected ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 to before 58007fc7b94fb2702000045ff401eb7f5bde7828Affected ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 to before df13c9c6ce1d55c31d1bd49db65a7fbbd86aab13Affected ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 to before bf58e667af7d96c8eb9411f926a0a0955f41ce21Affected
LinuxLinux	3.3Affected before 3.3Not affected 5.4.297 through 5.4.Not affected 5.10.241 through 5.10.Not affected 5.15.190 through 5.15.Not affected 6.1.148 through 6.1.Not affected 6.6.102 through 6.6.Not affected 6.12.42 through 6.12.Not affected 6.15.10 through 6.15.Not affected 6.16.1 through 6.16.Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 to before 66d41268ede1e1b6e71ba28be923397ff0b2b9c3Affected
ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 to before e021a1eee196887536a6630c5492c23a4c78d452Affected
ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 to before b10cfa2de13d28ddd03210eb234422b7ec92725aAffected
ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 to before e18939176e657a3a20bfbed357b8c55a9f82aba3Affected
ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 to before 58004aa21e79addaf41667bfe65e93ec51653f18Affected
ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 to before 7c1ae471da69c09242834e956218ea6a42dd405aAffected
ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 to before 58007fc7b94fb2702000045ff401eb7f5bde7828Affected
ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 to before df13c9c6ce1d55c31d1bd49db65a7fbbd86aab13Affected
ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 to before bf58e667af7d96c8eb9411f926a0a0955f41ce21Affected

LinuxLinux

3.3Affected
before 3.3Not affected
5.4.297 through 5.4.*Not affected
5.10.241 through 5.10.*Not affected
5.15.190 through 5.15.*Not affected
6.1.148 through 6.1.*Not affected
6.6.102 through 6.6.*Not affected
6.12.42 through 6.12.*Not affected
6.15.10 through 6.15.*Not affected
6.16.1 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.