Security readout for executives and security teams
Plain-English summary
A local user may trigger an out-of-bounds kernel memory read when Linux processes a malformed netfilter accounting name. Based on the supplied CVSS assessment, consequences may include sensitive kernel-memory exposure or a system crash. No active exploitation is established by the supplied sources.
Executive priority
Treat as a high-priority kernel maintenance issue on multi-user, shared-hosting, and container-node systems. Accelerate patching where untrusted local users exist. Internet-facing status alone does not imply direct exposure because the documented attack vector is local.
Technical view
The xt_nfacct match validation path passes a potentially non-null-terminated accounting name into an error-formatting operation. KASAN observed a slab-out-of-bounds read in string formatting through nfacct_mt_checkentry(). Linux stable commits correct the unsafe assumption. The supplied data rates this CVSS 3.1 score 7.1 with local, low-privilege access.
Likely exposure
Prioritize Linux systems running affected or unpatched vendor kernels where local users can reach the xt_nfacct/netfilter accounting configuration path. The bundle identifies affected Linux versions or branch points from 3.3 through 6.17, but it does not provide reliable distribution-specific backport status.
Exploitation context
The supplied record is not in KEV and provides no evidence of exploitation in the wild. Triggering is local, requires low privileges according to the CVSS vector, and needs no user interaction. The evidence demonstrates a KASAN-detected out-of-bounds read; it does not document a practical exploit.
Researcher notes
The observed fault is a one-byte-at-a-time slab over-read in lib/vsprintf string handling, reached from nfacct_mt_checkentry(). The error path assumed an accounting name was null-terminated. Source evidence supports confidentiality and availability impact ratings, but does not establish exploit reliability, privilege escalation, affected configuration prerequisites, or weaponization.
Mitigation direction
- Install a vendor kernel package containing the applicable Linux stable fix.
- Review Linux distribution advisories for branch-specific fixed package versions.
- Restrict unnecessary local account access until affected kernels are updated.
- Follow vendor guidance if immediate kernel replacement is operationally impractical.
Validation and detection
- Inventory running kernel versions across Linux hosts and container nodes.
- Check vendor package changelogs for CVE-2025-38639 or referenced fix commits.
- Determine whether xt_nfacct functionality is present and operationally required.
- Reboot after updating, then confirm the running kernel matches the fixed package.
- Review kernel logs for related KASAN or out-of-bounds reports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38639 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/66d41268ede1e1b6e71ba28be923397ff0b2b9c3CVE reference, Linux
- https://git.kernel.org/stable/c/e021a1eee196887536a6630c5492c23a4c78d452CVE reference, Linux
- https://git.kernel.org/stable/c/b10cfa2de13d28ddd03210eb234422b7ec92725aCVE reference, Linux
- https://git.kernel.org/stable/c/e18939176e657a3a20bfbed357b8c55a9f82aba3CVE reference, Linux
- https://git.kernel.org/stable/c/58004aa21e79addaf41667bfe65e93ec51653f18CVE reference, Linux
- https://git.kernel.org/stable/c/7c1ae471da69c09242834e956218ea6a42dd405aCVE reference, Linux
- https://git.kernel.org/stable/c/58007fc7b94fb2702000045ff401eb7f5bde7828CVE reference, Linux
- https://git.kernel.org/stable/c/df13c9c6ce1d55c31d1bd49db65a7fbbd86aab13CVE reference, Linux
- https://git.kernel.org/stable/c/bf58e667af7d96c8eb9411f926a0a0955f41ce21CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.