High 7.1Published Aug 22, 2025

CVE-2025-38639netfilter: xt_nfacct: don't assume acct name is null-terminated

Updated under an hour ago (Oct 27, 2026, 2:10 PM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_nfacct: don't assume acct name is null-terminated BUG: KASAN: slab-out-of-bounds in .. lib/vsprintf.c:721 Read of size 1 at addr ffff88801eac95c8 by task syz-executor183/5851 [..] string+0x231/0x2b0 lib/vsprintf.c:721 vsnprintf+0x739/0xf00 lib/vsprintf.c:2874 [..] nfacct_mt_checkentry+0xd2/0xe0 net/netfilter/xt_nfacct.c:41 xt_check_match+0x3d1/0xab0 net/netfilter/x_tables.c:523 nfnl_acct_find_get() handles non-null input, but the error printk relied on its presence.

CVSS: 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 before 66d41268ede1e1b6e71ba28be923397ff0b2b9c3; from ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 before e021a1eee196887536a6630c5492c23a4c78d452; from ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 before b10cfa2de13d28ddd03210eb234422b7ec92725a; from ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 before e18939176e657a3a20bfbed357b8c55a9f82aba3; from ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 before 58004aa21e79addaf41667bfe65e93ec51653f18; from ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 before 7c1ae471da69c09242834e956218ea6a42dd405a; from ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 before 58007fc7b94fb2702000045ff401eb7f5bde7828; from ceb98d03eac5704820f2ac1f370c9ff385e3a9f5 before df13c9c6ce1d55c31d1bd49db65a7fbbd86aab13; and 1 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 3.3 before 5.4.297; from 5.5 before 5.10.241; from 5.11 before 5.15.190; from 5.16 before 6.1.148; from 6.2 before 6.6.102; from 6.7 before 6.12.42; from 6.13 before 6.15.10; from 6.16 before 6.16.1	NVD
debian debian_linux debian:debian_linux	11.0	NVD

References

References

https://git.kernel.org/stable/c/66d41268ede1e1b6e71ba28be923397ff0b2b9c3	patch
https://git.kernel.org/stable/c/e021a1eee196887536a6630c5492c23a4c78d452	patch
https://git.kernel.org/stable/c/b10cfa2de13d28ddd03210eb234422b7ec92725a	patch
https://git.kernel.org/stable/c/e18939176e657a3a20bfbed357b8c55a9f82aba3	patch
https://git.kernel.org/stable/c/58004aa21e79addaf41667bfe65e93ec51653f18	patch
https://git.kernel.org/stable/c/7c1ae471da69c09242834e956218ea6a42dd405a	patch
https://git.kernel.org/stable/c/58007fc7b94fb2702000045ff401eb7f5bde7828	patch
https://git.kernel.org/stable/c/df13c9c6ce1d55c31d1bd49db65a7fbbd86aab13	patch
https://git.kernel.org/stable/c/bf58e667af7d96c8eb9411f926a0a0955f41ce21	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html	third-party-advisory
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.