In the Linux kernel, the following vulnerability has been resolved:
pptp: ensure minimal skb length in pptp_xmit()
Commit aabc6596ffb3 ("net: ppp: Add bound checking for skb data on pppsynctxmung") fixed pppsynctxmunge()
We need a similar fix in pptp_xmit(), otherwise we might read uninit data as reported by syzbot.
BUG: KMSAN: uninit-value in pptpxmit+0xc34/0x2720 drivers/net/ppp/pptp.c:193 pptpxmit+0xc34/0x2720 drivers/net/ppp/pptp.c:193 pppchannelbridgeinput drivers/net/ppp/pppgeneric.c:2290 [inline] pppinput+0x1d6/0xe60 drivers/net/ppp/pppgeneric.c:2314 pppoercvcore+0x1e8/0x760 drivers/net/ppp/pppoe.c:379 skbacklogrcv+0x142/0x420 include/net/sock.h:1148 releasesock+0x1d3/0x330 net/core/sock.c:3213 releasesock+0x6b/0x270 net/core/sock.c:3767 pppoesendmsg+0x15d/0xcb0 drivers/net/ppp/pppoe.c:904 socksendmsgnosec net/socket.c:712 [inline] _socksendmsg+0x330/0x3d0 net/socket.c:727 _syssendmsg+0x893/0xd80 net/socket.c:2566 _syssendmsg+0x271/0x3b0 net/socket.c:2620 _syssendmmsg+0x2d9/0x7c0 net/socket.c:2709
[
{
"signature_type": "Function",
"target": {
"function": "pptp_xmit",
"file": "drivers/net/ppp/pptp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@504cc4ab91073d2ac7404ad146139f86ecee7193",
"digest": {
"length": 2685.0,
"function_hash": "141608898189746149431791735240734033380"
},
"id": "CVE-2025-38574-213f9660",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "drivers/net/ppp/pptp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26672f1679b143aa34fca0b6046b7fd0c184770d",
"digest": {
"line_hashes": [
"44388441029492126185771584853449384376",
"88781259773908989073702521402676898689",
"186616273056157167970464964169978204862",
"284947510952145508655060513235891080762",
"259920482743403447349029837654047059440",
"129210279768559446351627491178429865888",
"70258969616918520612099207757790982107",
"933525736184480332371215249781119921",
"298022836322915723290521480219371970444",
"328994863583839602859171627373486207634",
"296723797741894418792822370895947548603",
"174228782000470827288662521834010140752",
"40344358523342079320444312793316515289",
"339978105444516847586518646600350797905",
"295285456013425583556294105735158513189",
"93465443346597284519930091205458836444",
"260307575110909188375320474507145165088",
"280308891382757026099843250804278923889",
"105561892669578388818891419617763606041",
"310301286579614108380058413688296673404"
],
"threshold": 0.9
},
"id": "CVE-2025-38574-2e469241",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "pptp_xmit",
"file": "drivers/net/ppp/pptp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a04db0fd75cb6034fc27a56b67b3b8b9022a98c",
"digest": {
"length": 2673.0,
"function_hash": "33370514846990204837798120803061228536"
},
"id": "CVE-2025-38574-34f60569",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "pptp_xmit",
"file": "drivers/net/ppp/pptp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea99b88b1999ebcb24d5d3a6b7910030f40d3bba",
"digest": {
"length": 2673.0,
"function_hash": "33370514846990204837798120803061228536"
},
"id": "CVE-2025-38574-3648ef78",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "pptp_xmit",
"file": "drivers/net/ppp/pptp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de9c4861fb42f0cd72da844c3c34f692d5895b7b",
"digest": {
"length": 2673.0,
"function_hash": "33370514846990204837798120803061228536"
},
"id": "CVE-2025-38574-5516e1ef",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "pptp_xmit",
"file": "drivers/net/ppp/pptp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@97b8c5d322c5c0038cac4bc56fdbe237d0be426f",
"digest": {
"length": 2811.0,
"function_hash": "154623826280917959045018404030244323678"
},
"id": "CVE-2025-38574-57c2ebbb",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "drivers/net/ppp/pptp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5005d24377378a20e5c0e53052fc4ebdcdcbc611",
"digest": {
"line_hashes": [
"44388441029492126185771584853449384376",
"88781259773908989073702521402676898689",
"186616273056157167970464964169978204862",
"284947510952145508655060513235891080762",
"259920482743403447349029837654047059440",
"129210279768559446351627491178429865888",
"70258969616918520612099207757790982107",
"933525736184480332371215249781119921",
"298022836322915723290521480219371970444",
"328994863583839602859171627373486207634",
"296723797741894418792822370895947548603",
"174228782000470827288662521834010140752",
"40344358523342079320444312793316515289",
"339978105444516847586518646600350797905",
"295285456013425583556294105735158513189",
"93465443346597284519930091205458836444",
"260307575110909188375320474507145165088",
"280308891382757026099843250804278923889",
"105561892669578388818891419617763606041",
"310301286579614108380058413688296673404"
],
"threshold": 0.9
},
"id": "CVE-2025-38574-6840358b",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "drivers/net/ppp/pptp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de9c4861fb42f0cd72da844c3c34f692d5895b7b",
"digest": {
"line_hashes": [
"44388441029492126185771584853449384376",
"88781259773908989073702521402676898689",
"186616273056157167970464964169978204862",
"284947510952145508655060513235891080762",
"259920482743403447349029837654047059440",
"129210279768559446351627491178429865888",
"70258969616918520612099207757790982107",
"933525736184480332371215249781119921",
"298022836322915723290521480219371970444",
"328994863583839602859171627373486207634",
"296723797741894418792822370895947548603",
"174228782000470827288662521834010140752",
"40344358523342079320444312793316515289",
"339978105444516847586518646600350797905",
"295285456013425583556294105735158513189",
"93465443346597284519930091205458836444",
"260307575110909188375320474507145165088",
"280308891382757026099843250804278923889",
"105561892669578388818891419617763606041",
"310301286579614108380058413688296673404"
],
"threshold": 0.9
},
"id": "CVE-2025-38574-68dcc403",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "drivers/net/ppp/pptp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@504cc4ab91073d2ac7404ad146139f86ecee7193",
"digest": {
"line_hashes": [
"44388441029492126185771584853449384376",
"88781259773908989073702521402676898689",
"186616273056157167970464964169978204862",
"284947510952145508655060513235891080762",
"259920482743403447349029837654047059440",
"129210279768559446351627491178429865888",
"70258969616918520612099207757790982107",
"933525736184480332371215249781119921",
"298022836322915723290521480219371970444",
"328994863583839602859171627373486207634",
"296723797741894418792822370895947548603",
"174228782000470827288662521834010140752",
"40344358523342079320444312793316515289",
"339978105444516847586518646600350797905",
"295285456013425583556294105735158513189",
"93465443346597284519930091205458836444",
"260307575110909188375320474507145165088",
"280308891382757026099843250804278923889",
"105561892669578388818891419617763606041",
"310301286579614108380058413688296673404"
],
"threshold": 0.9
},
"id": "CVE-2025-38574-74909281",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "drivers/net/ppp/pptp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a04db0fd75cb6034fc27a56b67b3b8b9022a98c",
"digest": {
"line_hashes": [
"44388441029492126185771584853449384376",
"88781259773908989073702521402676898689",
"186616273056157167970464964169978204862",
"284947510952145508655060513235891080762",
"259920482743403447349029837654047059440",
"129210279768559446351627491178429865888",
"70258969616918520612099207757790982107",
"933525736184480332371215249781119921",
"298022836322915723290521480219371970444",
"328994863583839602859171627373486207634",
"296723797741894418792822370895947548603",
"174228782000470827288662521834010140752",
"40344358523342079320444312793316515289",
"339978105444516847586518646600350797905",
"295285456013425583556294105735158513189",
"93465443346597284519930091205458836444",
"260307575110909188375320474507145165088",
"280308891382757026099843250804278923889",
"105561892669578388818891419617763606041",
"310301286579614108380058413688296673404"
],
"threshold": 0.9
},
"id": "CVE-2025-38574-8349c3b9",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "pptp_xmit",
"file": "drivers/net/ppp/pptp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26672f1679b143aa34fca0b6046b7fd0c184770d",
"digest": {
"length": 2685.0,
"function_hash": "141608898189746149431791735240734033380"
},
"id": "CVE-2025-38574-ac7ebc33",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "pptp_xmit",
"file": "drivers/net/ppp/pptp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7dcda76fd0615c0599c89f36873a6cd48e02dbb",
"digest": {
"length": 2673.0,
"function_hash": "33370514846990204837798120803061228536"
},
"id": "CVE-2025-38574-c190c5f2",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "pptp_xmit",
"file": "drivers/net/ppp/pptp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5005d24377378a20e5c0e53052fc4ebdcdcbc611",
"digest": {
"length": 2673.0,
"function_hash": "33370514846990204837798120803061228536"
},
"id": "CVE-2025-38574-c30dd1fa",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "pptp_xmit",
"file": "drivers/net/ppp/pptp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5de7513f38f3c19c0610294ee478242bea356f8c",
"digest": {
"length": 2685.0,
"function_hash": "141608898189746149431791735240734033380"
},
"id": "CVE-2025-38574-c66cb882",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "drivers/net/ppp/pptp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea99b88b1999ebcb24d5d3a6b7910030f40d3bba",
"digest": {
"line_hashes": [
"44388441029492126185771584853449384376",
"88781259773908989073702521402676898689",
"186616273056157167970464964169978204862",
"284947510952145508655060513235891080762",
"259920482743403447349029837654047059440",
"129210279768559446351627491178429865888",
"70258969616918520612099207757790982107",
"933525736184480332371215249781119921",
"298022836322915723290521480219371970444",
"328994863583839602859171627373486207634",
"296723797741894418792822370895947548603",
"174228782000470827288662521834010140752",
"40344358523342079320444312793316515289",
"339978105444516847586518646600350797905",
"295285456013425583556294105735158513189",
"93465443346597284519930091205458836444",
"260307575110909188375320474507145165088",
"280308891382757026099843250804278923889",
"105561892669578388818891419617763606041",
"310301286579614108380058413688296673404"
],
"threshold": 0.9
},
"id": "CVE-2025-38574-d458594c",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "drivers/net/ppp/pptp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5de7513f38f3c19c0610294ee478242bea356f8c",
"digest": {
"line_hashes": [
"44388441029492126185771584853449384376",
"88781259773908989073702521402676898689",
"186616273056157167970464964169978204862",
"284947510952145508655060513235891080762",
"259920482743403447349029837654047059440",
"129210279768559446351627491178429865888",
"70258969616918520612099207757790982107",
"933525736184480332371215249781119921",
"298022836322915723290521480219371970444",
"328994863583839602859171627373486207634",
"296723797741894418792822370895947548603",
"174228782000470827288662521834010140752",
"40344358523342079320444312793316515289",
"339978105444516847586518646600350797905",
"295285456013425583556294105735158513189",
"93465443346597284519930091205458836444",
"260307575110909188375320474507145165088",
"280308891382757026099843250804278923889",
"105561892669578388818891419617763606041",
"310301286579614108380058413688296673404"
],
"threshold": 0.9
},
"id": "CVE-2025-38574-de7722e9",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "drivers/net/ppp/pptp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7dcda76fd0615c0599c89f36873a6cd48e02dbb",
"digest": {
"line_hashes": [
"44388441029492126185771584853449384376",
"88781259773908989073702521402676898689",
"186616273056157167970464964169978204862",
"284947510952145508655060513235891080762",
"259920482743403447349029837654047059440",
"129210279768559446351627491178429865888",
"70258969616918520612099207757790982107",
"933525736184480332371215249781119921",
"298022836322915723290521480219371970444",
"328994863583839602859171627373486207634",
"296723797741894418792822370895947548603",
"174228782000470827288662521834010140752",
"40344358523342079320444312793316515289",
"339978105444516847586518646600350797905",
"295285456013425583556294105735158513189",
"93465443346597284519930091205458836444",
"260307575110909188375320474507145165088",
"280308891382757026099843250804278923889",
"105561892669578388818891419617763606041",
"310301286579614108380058413688296673404"
],
"threshold": 0.9
},
"id": "CVE-2025-38574-ebbc8b0c",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "drivers/net/ppp/pptp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@97b8c5d322c5c0038cac4bc56fdbe237d0be426f",
"digest": {
"line_hashes": [
"44388441029492126185771584853449384376",
"88781259773908989073702521402676898689",
"186616273056157167970464964169978204862",
"284947510952145508655060513235891080762",
"259920482743403447349029837654047059440",
"129210279768559446351627491178429865888",
"70258969616918520612099207757790982107",
"933525736184480332371215249781119921",
"298022836322915723290521480219371970444",
"328994863583839602859171627373486207634",
"296723797741894418792822370895947548603",
"174228782000470827288662521834010140752",
"40344358523342079320444312793316515289",
"339978105444516847586518646600350797905",
"295285456013425583556294105735158513189",
"93465443346597284519930091205458836444",
"260307575110909188375320474507145165088",
"280308891382757026099843250804278923889",
"105561892669578388818891419617763606041",
"310301286579614108380058413688296673404"
],
"threshold": 0.9
},
"id": "CVE-2025-38574-f2971b29",
"signature_version": "v1",
"deprecated": false
}
]