5.5

CVE-2025-38639

netfilter: xt_nfacct: don't assume acct name is null-terminated

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_nfacct: don't assume acct name is null-terminated

BUG: KASAN: slab-out-of-bounds in .. lib/vsprintf.c:721
Read of size 1 at addr ffff88801eac95c8 by task syz-executor183/5851
[..]
 string+0x231/0x2b0 lib/vsprintf.c:721
 vsnprintf+0x739/0xf00 lib/vsprintf.c:2874
 [..]
 nfacct_mt_checkentry+0xd2/0xe0 net/netfilter/xt_nfacct.c:41
 xt_check_match+0x3d1/0xab0 net/netfilter/x_tables.c:523

nfnl_acct_find_get() handles non-null input, but the error
printk relied on its presence.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 3.3 < 5.4.297
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.241
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.190
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.148
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.102
Linux ≫ Linux Kernel Version >= 6.7 < 6.12.42
Linux ≫ Linux Kernel Version >= 6.13 < 6.15.10
Linux ≫ Linux Kernel Version >= 6.16 < 6.16.1
Debian ≫ Debian Linux Version11.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.16% 0.054
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/e18939176e657a3a20bfbed357b8c55a9f82aba3
Patch
https://git.kernel.org/stable/c/58004aa21e79addaf41667bfe65e93ec51653f18
Patch
https://git.kernel.org/stable/c/7c1ae471da69c09242834e956218ea6a42dd405a
Patch
https://git.kernel.org/stable/c/58007fc7b94fb2702000045ff401eb7f5bde7828
Patch
https://git.kernel.org/stable/c/df13c9c6ce1d55c31d1bd49db65a7fbbd86aab13
Patch
https://git.kernel.org/stable/c/bf58e667af7d96c8eb9411f926a0a0955f41ce21
Patch
https://git.kernel.org/stable/c/66d41268ede1e1b6e71ba28be923397ff0b2b9c3
Patch
https://git.kernel.org/stable/c/b10cfa2de13d28ddd03210eb234422b7ec92725a
Patch
https://git.kernel.org/stable/c/e021a1eee196887536a6630c5492c23a4c78d452
Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
Third Party Advisory