CVE-2025-38574

What it actually does

Missing length validation on skb in pptp_xmit allows reading uninitialized kernel memory when processing certain PPP/PPTP frames.

Why it matters to the business

Attackers with network access to affected Linux systems could obtain fragments of kernel memory, raising the risk of credential or secret leakage and complicating compliance for organizations running PPTP-based networking.

How an attack unfolds

An attacker sends specially crafted packets that reach pppoe_sendmsg and traverse ppp_input into pptp_xmit without triggering the length checks added in related PPP functions, causing the kernel to read uninitialized skb data that may be returned or logged.

How to fix it

Update the Linux kernel to commit 97b8c5d322c5c0038cac4bc56fdbe237d0be426f or later; for Chainguard images apply the packages fixed in 0.53.0-r0. Disable PPTP interfaces if not required.

How to confirm the fix worked

Confirm the running kernel contains commit 97b8c5d322c5c0038cac4bc56fdbe237d0be426f; recompile with KMSAN and verify the uninit-value report no longer triggers on the original syzbot reproducer.

Typical attack path

1. Craft network traffic that reaches a PPTP/PPP interface on the target
2. Trigger pppoe_rcv_core and subsequent ppp_input path
3. Force pptp_xmit to process an skb lacking the expected minimum length
4. Read the uninitialized bytes that are accessed at pptp.c:193

How to detect it

Search kernel logs for KMSAN uninit-value reports mentioning pptp_xmit; monitor for unusual PPTP session establishment from untrusted sources and inspect skb-related stack traces in ppp_generic and pppoe.

What your security team should do

• Apply the referenced kernel commit or distribution update within 30 days given the published date and EPSS trend
• Audit systems for active PPTP configurations and remove them where possible
• Add kernel memory-safety testing (KMSAN/KASAN) to CI for net/ppp drivers