CVE-2025-38441

What it actually does

Missing Ethernet header length accounting in nf_flow_pppoe_proto() causes nf_flow_offload_inet_hook to read uninitialized kernel memory during flow table offload processing for PPPoE traffic.

Why it matters to the business

Kernel memory contents may leak to user space or network paths on affected Linux systems handling certain ingress traffic, raising data exposure risk in high-throughput network environments.

How an attack unfolds

An attacker sends crafted PPPoE frames through a TUN or similar virtual interface that triggers the flow table inet hook; the uninitialized value read in nf_flow_pppoe_proto() can expose kernel stack data that is then processed or logged, potentially allowing information disclosure or aiding further kernel exploitation by advanced actors.

How to fix it

Update the Linux kernel to a version containing the fix that accounts for the Ethernet header in nf_flow_pppoe_proto(); apply the referenced commit that resolves the uninit-value access.

How to confirm the fix worked

Confirm the patch is present by checking the kernel source for the corrected nf_flow_pppoe_proto implementation and re-test with KMSAN or syzbot-style reproducers targeting the flow table hook.

Typical attack path

1. Craft and send PPPoE-tagged frames that reach nf_ingress
2. Trigger nf_flow_offload_inet_hook via netfilter flow table rules
3. Cause nf_flow_pppoe_proto to read past the accounted header
4. Observe or exfiltrate the uninitialized kernel value through side channels or logs

How to detect it

Review kernel logs for KMSAN reports mentioning nf_flow_offload_inet_hook or nf_flow_pppoe_proto; inspect netfilter flow table activity and TUN interface traffic for anomalous PPPoE frames around the time of suspected exposure.

What your security team should do

• Prioritize kernel upgrades on systems using netfilter flow tables and PPPoE
• Monitor EPSS trend and any new exploit maturity signals
• Restrict untrusted traffic reaching ingress hooks until patched