Security readout for executives and security teams
Plain-English summary
A Linux kernel flaw in PPTP packet transmission can read uninitialized memory when processing an undersized network buffer. The supplied CVSS 8.6 rating indicates possible confidentiality, integrity, and serious availability effects. Exposure is concentrated in systems using the kernel PPTP/PPP functionality, not every Linux host equally.
Executive priority
Treat as a high-priority infrastructure patch where PPTP is enabled or used. Accelerate remediation for exposed gateways and VPN systems. For hosts without this functionality, first validate applicability rather than initiating emergency-wide disruption. No supplied evidence supports declaring an active exploitation emergency.
Technical view
pptp_xmit() lacked a minimum socket-buffer length check before reading packet data. Kernel fuzzing with KMSAN detected an uninitialized-value read at drivers/net/ppp/pptp.c:193 through a PPP/PPPoE processing path. Linux stable commits add the missing validation; the bundle lists affected kernel series but does not provide unambiguous range notation.
Likely exposure
Prioritize Linux systems where PPTP kernel support is present and actively used, especially VPN, routing, gateway, or PPP infrastructure. The supplied version data spans numerous kernel generations, but its flattened representation makes exact affected and fixed boundaries unclear. Confirm status against distribution or kernel-vendor advisories.
Exploitation context
The issue was found by syzbot and demonstrated through a KMSAN uninitialized-memory report. The bundle marks it absent from KEV and provides no evidence of active exploitation or a public weaponized exploit. Network reachability is asserted by the CVSS vector, although practical prerequisites are not fully documented here.
Researcher notes
The observable defect is an undersized skb reaching pptp_xmit(), producing an uninitialized-value read. The trace traverses PPP bridge input and PPPoE receive/send paths, but the bundle does not establish all remotely controllable conditions. No CWE is assigned. Stable commits are available across kernel branches; exact branch mapping requires vendor confirmation.
Mitigation direction
- Install a vendor-supported kernel containing the applicable Linux stable fix.
- Check Linux distribution advisories for the corrected package version.
- If PPTP is unnecessary, evaluate disabling it under vendor guidance.
- Prioritize externally reachable VPN, gateway, and PPP systems.
Validation and detection
- Inventory kernel versions and systems using PPTP or related PPP functionality.
- Compare installed packages with distribution security advisories.
- Verify the applicable stable fix commit is included in the running kernel.
- After updating, confirm systems booted into the corrected kernel.
- Monitor kernel logs for PPTP, PPP, memory-safety, or crash indicators.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38574 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H3.94.7LinuxVulnerability scoring details
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/97b8c5d322c5c0038cac4bc56fdbe237d0be426fCVE reference, Linux
- https://git.kernel.org/stable/c/26672f1679b143aa34fca0b6046b7fd0c184770dCVE reference, Linux
- https://git.kernel.org/stable/c/5de7513f38f3c19c0610294ee478242bea356f8cCVE reference, Linux
- https://git.kernel.org/stable/c/504cc4ab91073d2ac7404ad146139f86ecee7193CVE reference, Linux
- https://git.kernel.org/stable/c/5005d24377378a20e5c0e53052fc4ebdcdcbc611CVE reference, Linux
- https://git.kernel.org/stable/c/ea99b88b1999ebcb24d5d3a6b7910030f40d3bbaCVE reference, Linux
- https://git.kernel.org/stable/c/b7dcda76fd0615c0599c89f36873a6cd48e02dbbCVE reference, Linux
- https://git.kernel.org/stable/c/1a04db0fd75cb6034fc27a56b67b3b8b9022a98cCVE reference, Linux
- https://git.kernel.org/stable/c/de9c4861fb42f0cd72da844c3c34f692d5895b7bCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.