CVE-2025-38441: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38441 is a vulnerability discovered in the Linux kernel's netfilter subsystem, specifically in the nfflowpppoe_proto() function. The vulnerability was identified on July 25, 2025, and involves an uninitialized value access issue in the netfilter flowtable implementation (NVD, RedHat).

The vulnerability stems from the netfilter flowtable implementation failing to account for the Ethernet header in nfflowpppoeproto(). This oversight results in potential access to uninitialized values in the nfflowoffloadinethook function, specifically at net/netfilter/nfflowtableinet.c:27. The issue has been assigned a CVSS v3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) (RedHat).

The vulnerability affects the kernel's network packet processing capabilities, specifically in the handling of PPPoE (Point-to-Point Protocol over Ethernet) traffic. The primary impact is potential system instability due to access to uninitialized memory values, which could lead to high availability impacts (RedHat).

Red Hat has indicated that fixes are deferred for Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10, while versions 6, 7, and 8 are not affected. The fix involves properly accounting for the Ethernet header in the nfflowpppoe_proto() function (RedHat).