CVE-2025-38639

What it actually does

Out-of-bounds read (KASAN slab-out-of-bounds) in vsnprintf during nfacct_mt_checkentry when acct name string lacks null termination, triggered from xt_check_match in netfilter xt_nfacct module.

Why it matters to the business

Kernel instability, potential crashes, or limited information disclosure on Linux systems using netfilter accounting; related privilege escalation activity observed in container-optimized OS environments increases urgency for patching despite low EPSS.

How an attack unfolds

Attacker supplies a specially crafted non-null-terminated account name via netfilter rule configuration; nfnl_acct_find_get accepts it but error logging path in nfacct_mt_checkentry performs unsafe string handling leading to OOB read; observed in campaigns by VMSCAPE and related container privilege escalation chains involving similar kernel flaws.

How to fix it

Update affected Linux kernel packages to versions resolving the non-null-terminated string handling in xt_nfacct; for listed firefox-esr (Debian:12) deployments apply 128.13.0esr-1~deb12u1 or later.

How to confirm the fix worked

Confirm kernel version after update contains the fix for xt_nfacct.c:41; test with syzkaller-style reproducers exercising nfacct_mt_checkentry with non-terminated strings; verify no KASAN reports on match entry checks.

Typical attack path

1. Craft netfilter xt_nfacct match entry with non-null-terminated acct name
2. Trigger xt_check_match during rule validation
3. Force error path invoking vsnprintf on malformed string
4. Achieve slab-out-of-bounds read for memory disclosure or denial of service

How to detect it

Review kernel logs for KASAN slab-out-of-bounds reports referencing vsnprintf or nfacct_mt_checkentry; inspect netfilter rule additions via auditd or xtables logs for unusual acct names; correlate with container runtime events tied to VMSCAPE or listed privilege escalation campaigns.

What your security team should do

• Prioritize kernel updates on systems with netfilter enabled given container-related threat actor activity
• Audit netfilter rulesets for any acct name handling
• Monitor EPSS trend and related CVEs (CVE-2025-38617, CVE-2025-38618) for combined exploitation risk
• Apply firefox-esr updates to 128.13.0esr-1~deb12u1 where applicable