CVE-2025-38061

What it actually does

Out-of-bounds memory read in pktgen_thread_write() because strn_len() calls ignore the caller-supplied buffer length and continue past the end of the user-provided buffer.

Why it matters to the business

Unpatched Linux systems may experience kernel crashes, memory corruption, or local privilege escalation when pktgen is used, raising operational risk for any environment running the affected kernel versions.

How an attack unfolds

An attacker with write access to the pktgen procfs interface supplies a crafted buffer whose length is smaller than the data read by strn_len(); the kernel then accesses memory beyond the user allocation, enabling information disclosure or further memory corruption that can be chained into privilege escalation by known Linux kernel threat actors.

How to fix it

Upgrade the Linux kernel to the commit a3d89f1cfe1e6d4bb164db2595511fd33db21900 or later; for Mageia 5 systems also apply perl 5.20.1-8.1.mga5 and perl-PathTools 3.470.0-7.1.mga5 updates. Reboot after kernel replacement.

How to confirm the fix worked

Confirm the running kernel contains commit a3d89f1cfe1e6d4bb164db2595511fd33db21900 (via git log or kernel version string) and test that writes to pktgen procfs files no longer produce out-of-bounds accesses under fuzzer or manual boundary testing.

Typical attack path

1. Obtain local access or execute code as an unprivileged user on a system exposing /proc/net/pktgen
2. Open and write a specially sized buffer to a pktgen control file
3. Trigger strn_len() to read past the supplied length
4. Leverage resulting out-of-bounds read for memory disclosure or corruption
5. Escalate to root via kernel memory primitives

How to detect it

Review kernel logs and audit trails for unusual writes to pktgen procfs files; correlate with any process that opens /proc/net/pktgen and subsequently triggers kernel oops or page-fault reports near strn_len.

What your security team should do

• Apply the kernel patch or distribution update immediately given the 496 days since publication and continued low-level EPSS growth
• Disable or restrict pktgen procfs access on systems that do not require it
• Monitor for new exploit code targeting this class of buffer-handling flaws in the Linux kernel
• Include the fixed commit hash in automated kernel version scanning