CVE-2025-38639 – This CVE describes a kernel memory corruption v... (How to Fix)

Q: What is the severity of CVE-2025-38639?

CVE-2025-38639 has a CVSS score of 5.5 (MEDIUM). This CVE describes a kernel memory corruption vulnerability in the Linux netfilter subsystem's xt_nfacct module. The vulnerability occurs when the module incorrectly assumes that an accounting name string is null-terminated, leading to potential out-of-bounds memory reads. This affects Linux systems using netfilter with the nfacct match extension.

📋 TL;DR

This CVE describes a kernel memory corruption vulnerability in the Linux netfilter subsystem's xt_nfacct module. The vulnerability occurs when the module incorrectly assumes that an accounting name string is null-terminated, leading to potential out-of-bounds memory reads. This affects Linux systems using netfilter with the nfacct match extension.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected kernel versions not specified in CVE, but patches exist for multiple stable branches

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if netfilter with xt_nfacct module is loaded and used. Many systems may not have this module enabled by default.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or system crash due to out-of-bounds memory access, potentially leading to denial of service or information disclosure of kernel memory contents.

🟠

Likely Case

System instability or crash when specific netfilter rules with malformed nfacct names are processed, resulting in denial of service.

🟢

If Mitigated

Minimal impact if systems don't use the affected xt_nfacct module or have proper kernel hardening protections enabled.

🌐 Internet-Facing: LOW - Requires local access or specific netfilter rule manipulation, not directly exploitable from network.

🏢 Internal Only: MEDIUM - Local users or processes with CAP_NET_ADMIN capabilities could trigger the vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires CAP_NET_ADMIN privileges or local access to manipulate netfilter rules. The vulnerability is a read-only out-of-bounds access, limiting exploitation potential.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with commits: 58004aa21e79, 58007fc7b94f, 66d41268ede1, 7c1ae471da69, b10cfa2de13d

Vendor Advisory: https://git.kernel.org/stable/c/58004aa21e79addaf41667bfe65e93ec51653f18

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version matches patched release.

🔧 Temporary Workarounds

Disable xt_nfacct module

Linux

Unload the vulnerable kernel module if not required

rmmod xt_nfacct
echo 'blacklist xt_nfacct' > /etc/modprobe.d/disable-nfacct.conf

Restrict CAP_NET_ADMIN

Linux

Limit which users/processes can manipulate netfilter rules

setcap -r /path/to/binary cap_net_admin
Use security modules like SELinux/AppArmor to restrict netfilter access

🧯 If You Can't Patch

Ensure only trusted users have CAP_NET_ADMIN capabilities
Monitor system logs for kernel panic or KASAN error messages related to netfilter

🔍 How to Verify

Check if Vulnerable:

Check if xt_nfacct module is loaded: lsmod | grep nfacct

Check Version:

uname -r

Verify Fix Applied:

Check kernel version against patched releases from your distribution, verify module is not loaded or system is updated

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
KASAN error reports mentioning xt_nfacct or nfacct_mt_checkentry
System crash/reboot logs

Network Indicators:

Unusual netfilter rule modifications
Failed netfilter rule additions

SIEM Query:

source="kernel" AND ("KASAN" OR "slab-out-of-bounds" OR "xt_nfacct" OR "nfacct_mt_checkentry")

📊 Metadata

CVE ID: CVE-2025-38639

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score: 0.01% exploit probability (2.3th percentile)

Published: August 22, 2025

Last Updated: January 7, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON