---
id: CVE-2025-38639
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: xt_nfacct: don't assume acct name is null-terminated

  BUG: KASAN: slab-out-of-bounds in .
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: xt_nfacct: don't assume acct name is null-terminated

  BUG: KASAN: slab-out-of-bounds in .. lib/vsprintf.c:721
  Read of size 1 at addr ffff88801eac95c8 by task…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 3.3, < 5.4.297'
  - 'linux_kernel >= 5.5, < 5.10.241'
  - 'linux_kernel >= 5.11, < 5.15.190'
  - 'linux_kernel >= 5.16, < 6.1.148'
  - 'linux_kernel >= 6.2, < 6.6.102'
  - 'linux_kernel >= 6.7, < 6.12.42'
  - 'linux_kernel >= 6.13, < 6.15.10'
  - 'linux_kernel >= 6.16, < 6.16.1'
  - debian_linux = 11.0
patched:
  - linux_kernel 6.16.1
published: '2025-08-22'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:47.683'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-38639'
references:
  - url: 'https://git.kernel.org/stable/c/58004aa21e79addaf41667bfe65e93ec51653f18'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/58007fc7b94fb2702000045ff401eb7f5bde7828'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/66d41268ede1e1b6e71ba28be923397ff0b2b9c3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7c1ae471da69c09242834e956218ea6a42dd405a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b10cfa2de13d28ddd03210eb234422b7ec92725a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bf58e667af7d96c8eb9411f926a0a0955f41ce21'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/df13c9c6ce1d55c31d1bd49db65a7fbbd86aab13'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e021a1eee196887536a6630c5492c23a4c78d452'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e18939176e657a3a20bfbed357b8c55a9f82aba3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
epss: 0.00187
epssPercentile: 0.08191
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-15T21:52:25.310432Z'
ingestedAt: '2026-10-15T22:48:25.516Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_nfacct: don't assume acct name is null-terminated

BUG: KASAN: slab-out-of-bounds in .. lib/vsprintf.c:721
Read of size 1 at addr ffff88801eac95c8 by task syz-executor183/5851
[..]
 string+0x231/0x2b0 lib/vsprintf.c:721
 vsnprintf+0x739/0xf00 lib/vsprintf.c:2874
 [..]
 nfacct_mt_checkentry+0xd2/0xe0 net/netfilter/xt_nfacct.c:41
 xt_check_match+0x3d1/0xab0 net/netfilter/x_tables.c:523

nfnl_acct_find_get() handles non-null input, but the error
printk relied on its presence.

## Affected

- `linux_kernel >= 3.3, < 5.4.297`
- `linux_kernel >= 5.5, < 5.10.241`
- `linux_kernel >= 5.11, < 5.15.190`
- `linux_kernel >= 5.16, < 6.1.148`
- `linux_kernel >= 6.2, < 6.6.102`
- `linux_kernel >= 6.7, < 6.12.42`
- `linux_kernel >= 6.13, < 6.15.10`
- `linux_kernel >= 6.16, < 6.16.1`
- `debian_linux = 11.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.16.1`